Edit tour

Windows Analysis Report
RQ--029.msi

Overview

General Information

Sample name:	RQ--029.msi
Analysis ID:	1573599
MD5:	7ba4b194ce0469587c99e7b6b9eae46e
SHA1:	a858d6167b1d1c446d6c176e016b38651d569580
SHA256:	da46033b88ea09024d4dfb1e604f57b1ecbddfa630414190742e7a6e9e8d4ff3
Tags:	msiuser-Porcupine
Infos:

Detection

AteraAgent

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AteraAgent

AI detected suspicious sample

Creates files in the system32 config directory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Yara detected Generic Downloader

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses net.exe to stop services

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7324 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\RQ--029.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7368 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7448 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 3B85228B7D1C8929A727F0F59CB02AA3 MD5: 9D09DC1EDA745A5F87553048E57620CF)

rundll32.exe (PID: 7484 cmdline: rundll32.exe "C:\Windows\Installer\MSI25B4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5449250 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7552 cmdline: rundll32.exe "C:\Windows\Installer\MSI2CD9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5451000 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7652 cmdline: rundll32.exe "C:\Windows\Installer\MSI438F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5456796 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3132 cmdline: rundll32.exe "C:\Windows\Installer\MSI619B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5464500 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd MD5: 889B99C52A60DD49227C5E485A016679)

msiexec.exe (PID: 7728 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding CACFC9F983F5284DFDC6FC6746D31D7F E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

net.exe (PID: 7768 cmdline: "NET" STOP AteraAgent MD5: 31890A7DE89936F922D44D677F681A7F)

conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net1.exe (PID: 7816 cmdline: C:\Windows\system32\net1 STOP AteraAgent MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

taskkill.exe (PID: 7848 cmdline: "TaskKill.exe" /f /im AteraAgent.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AteraAgent.exe (PID: 7916 cmdline: "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="contato@opticaperformance.com.br" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000OJqMsIAL" /AgentId="14216fa6-dc15-4519-acf9-f0e1b34954b6" MD5: 477293F80461713D51A98A24023D45E8)

AteraAgent.exe (PID: 8100 cmdline: "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" MD5: 477293F80461713D51A98A24023D45E8)

sc.exe (PID: 3592 cmdline: "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000 MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AgentPackageAgentInformation.exe (PID: 5868 cmdline: "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dfd08f75-8b51-48fd-ab32-5327cfebcacf" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000OJqMsIAL MD5: 83FD950ED584099A4125EFBA77E26BAA)

conhost.exe (PID: 2128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AgentPackageAgentInformation.exe (PID: 1028 cmdline: "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "0b83ff3f-4e98-4112-9bc1-991064e5f975" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000OJqMsIAL MD5: 83FD950ED584099A4125EFBA77E26BAA)

conhost.exe (PID: 3652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8060 cmdline: "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cscript.exe (PID: 5724 cmdline: cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

AgentPackageAgentInformation.exe (PID: 5516 cmdline: "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dd995738-a43a-417d-bb93-8167d39082a0" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000OJqMsIAL MD5: 83FD950ED584099A4125EFBA77E26BAA)

conhost.exe (PID: 3180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AgentPackageSTRemote.exe (PID: 6516 cmdline: "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "6141f59d-aac4-4ed0-a2a6-5cc28d11fb39" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOm51bGwsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 001Q300000OJqMsIAL MD5: 67FEF41237025021CD4F792E8C24E95A)

conhost.exe (PID: 6540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AgentPackageMonitoring.exe (PID: 5100 cmdline: "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "be3e4666-7f93-4f4c-b51b-88298548f7af" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000OJqMsIAL MD5: 5E3252E0248B484E76FCDBF8B42A645D)

conhost.exe (PID: 5820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AteraAgent.exe (PID: 6400 cmdline: "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" MD5: 477293F80461713D51A98A24023D45E8)

sc.exe (PID: 7452 cmdline: "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000 MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sppsvc.exe (PID: 7052 cmdline: C:\Windows\system32\sppsvc.exe MD5: 320823F03672CEB82CC3A169989ABD12)

svchost.exe (PID: 7112 cmdline: C:\Windows\System32\svchost.exe -k smphost MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Temp\~DFCC6C8BB60B211B04.TMP	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Temp\~DFBDF63F9E0954AA6F.TMP	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Config.Msi\5323c1.rbs	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Temp\~DFB522218AED2B124F.TMP	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Installer\MSI438F.tmp-\AlphaControlAgentInstallation.dll	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.ModelsV3.dll	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Temp\~DF1FF2901819542AF9.TMP	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Temp\~DF49C6D83430A3FBE8.TMP	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Installer\MSI25B4.tmp-\AlphaControlAgentInstallation.dll	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Installer\MSI619B.tmp-\AlphaControlAgentInstallation.dll	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Installer\inprogressinstallinfo.ipi	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Installer\MSI2CD9.tmp-\AlphaControlAgentInstallation.dll	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\System32\InstallUtil.InstallLog	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\System32\InstallUtil.InstallLog	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Installer\MSI4584.tmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.CommonLib.dll	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Temp\~DF4EFA9AAB73D0778C.TMP	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Windows\Temp\~DF4EFA9AAB73D0778C.TMP	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.Utils.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Click to see the 21 entries

Memory Dumps

Source	Rule	Description	Author
00000015.00000002.2608580404.000002621447C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2828323869.000001DDE4DB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001E.00000002.2703342225.0000021125FFC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000004.00000002.1749347665.00000000044E4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2910170206.0000001534165000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2933946577.0000015E3BE3D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000011.00000002.1883270062.0000000004954000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2933946577.0000015E3BC5E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2921232065.000001B2C69A6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821854743.000001DF82FB2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821854743.000001DF8307C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2926789320.0000015E3B22C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2925832359.0000015E3B1C0000.00000004.00000020.00040000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000000.2669697402.000002BDDBED2000.00000002.00000001.01000000.0000001A.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2911502671.00000039F5375000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1823822816.000001DF9B78E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2956305413.000001A41FB7F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000015.00000002.2608580404.0000026214380000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2920984998.000001A406B70000.00000004.00000020.00040000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2827219433.000001DDE438A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000000.1766473024.000001DF810F2000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1826138736.00007FFD9B414000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000002.2923031816.000002BDDC240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2926775706.000001B2C6FD8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821854743.000001DF82FBA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2922460675.000001A406E32000.00000002.00000001.01000000.0000001D.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2956305413.000001A41FBB9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2964905053.0000015E54720000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2933946577.0000015E3BDC4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2958992188.0000015E54373000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2954879800.000001B2DFC7D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2966506202.0000015E547DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2828323869.000001DDE4DDF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821854743.000001DF83066000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821854743.000001DF82F89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000002.2940815641.000002BDF5147000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000002.2918270056.000002BDDC0A1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2921232065.000001B2C6920000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821854743.000001DF82FB4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2837681843.000001DDFD673000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000002.2918270056.000002BDDC06C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2954879800.000001B2DFC20000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000019.00000002.2637732373.00000221AC452000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001E.00000002.2703342225.0000021125FF0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001E.00000003.2638815527.0000021126220000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2835065748.000001DDFD432000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000002.2918270056.000002BDDC060000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000011.00000002.1883270062.00000000048B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2964825175.000001A420C08000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000015.00000002.2609356829.0000026214B31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821854743.000001DF83032000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000015.00000002.2609078888.00000262145B0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2921232065.000001B2C69DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1820419607.000001DF8119C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000015.00000002.2610343948.000002622D40B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2926775706.000001B2C6F41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2933946577.0000015E3BE41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2836087609.000001DDFD58C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000002.2927182354.000002BDDCACB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000015.00000002.2608580404.000002621440C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2926775706.000001B2C6FC4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2921232065.000001B2C6928000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000015.00000002.2609275400.0000026214AE2000.00000002.00000001.01000000.00000018.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2828323869.000001DDE4DE3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2921232065.000001B2C6959000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2924474756.000001A4073A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2933946577.0000015E3C417000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2827219433.000001DDE435B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821854743.000001DF82F8C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2933946577.0000015E3C3EB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2926775706.000001B2C6FCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2828323869.000001DDE4E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2835842751.000001DDFD4DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1820498326.000001DF811BC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2924503092.000001B2C6BB0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001E.00000002.2703342225.0000021126013000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2918487841.000001A406A7C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000019.00000002.2638542145.00000221ACC23000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000015.00000002.2608580404.00000262143C0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2918487841.000001A406B01000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2933946577.0000015E3BCF8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000019.00000002.2637732373.00000221AC3D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2954879800.000001B2DFCA7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1825116949.000001DF9B8CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2956305413.000001A41FB50000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000015.00000000.2560902012.00000262141B2000.00000002.00000001.01000000.00000016.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2918487841.000001A406A70000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2958992188.0000015E542F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1820498326.000001DF811B4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2828323869.000001DDE4C05000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000004.00000002.1749347665.0000000004441000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000015.00000002.2609356829.0000026214BB3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821854743.000001DF83035000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2962842731.0000015E54680000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2828323869.000001DDE4D1D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2926789320.0000015E3B274000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1820498326.000001DF811D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2926775706.000001B2C7095000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000019.00000002.2637732373.00000221AC3D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2933946577.0000015E3BBF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000015.00000002.2609356829.0000026214BA3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000019.00000002.2638542145.00000221ACC33000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001E.00000002.2703495802.0000021126200000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821201322.000001DF81530000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2926775706.000001B2C7122000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2827025394.000001DDE42D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000002.2927182354.000002BDDCB61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000002.2927182354.000002BDDCB53000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1820498326.000001DF811D3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2926789320.0000015E3B1F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2926775706.000001B2C725F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2921232065.000001B2C695C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2926775706.000001B2C6FE2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000002.2918270056.000002BDDC0AB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000019.00000002.2637732373.00000221AC40B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2933946577.0000015E3BE92000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2921596858.000001A406D10000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1820419607.000001DF81190000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2828323869.000001DDE4B71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000020.00000002.2701906266.0000023E082F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000019.00000002.2638542145.00000221ACBB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2833724925.000001DDFD399000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000D.00000002.2931929153.0000015E3B540000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000017.00000002.2827219433.000001DDE4320000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2918487841.000001A406AB4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000002.2918270056.000002BDDC0ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000019.00000002.2637651947.00000221AC390000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2984638251.00007FFDF1329000.00000004.00000001.01000000.0000001C.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2964703030.000001A4209F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1825116949.000001DF9B905000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1820498326.000001DF811F3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000002.2911496485.000000C5B43E1000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1820498326.000001DF81221000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821854743.000001DF82F01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000001B.00000002.2926775706.000001B2C71C4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
0000000C.00000002.1821284162.000001DF81550000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2910123007.00000014F27F0000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000022.00000002.2927182354.000002BDDCA51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: rundll32.exe PID: 7484	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: rundll32.exe PID: 7552	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: rundll32.exe PID: 7652	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: AteraAgent.exe PID: 7916	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: AteraAgent.exe PID: 8100	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: rundll32.exe PID: 3132	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: AgentPackageAgentInformation.exe PID: 5868	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: AgentPackageAgentInformation.exe PID: 1028	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: AgentPackageAgentInformation.exe PID: 5516	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: AteraAgent.exe PID: 6400	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: cmd.exe PID: 8060	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: cscript.exe PID: 5724	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: AgentPackageSTRemote.exe PID: 6516	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Process Memory Space: AgentPackageMonitoring.exe PID: 5100	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
Click to see the 158 entries

Unpacked PEs

Source	Rule	Description	Author
34.0.AgentPackageSTRemote.exe.2bddbed0000.0.unpack	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
21.2.AgentPackageAgentInformation.exe.26214ae0000.1.unpack	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
37.2.AgentPackageMonitoring.exe.1a406e30000.1.unpack	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
12.0.AteraAgent.exe.1df810f0000.0.unpack	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
37.0.AgentPackageMonitoring.exe.1a406980000.0.unpack	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
21.0.AgentPackageAgentInformation.exe.262141b0000.0.unpack	JoeSecurity_AteraAgent	Yara detected AteraAgent	Joe Security
21.0.AgentPackageAgentInformation.exe.262141b0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Click to see the 2 entries

Sigma Signatures

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus, CommandLine: cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus, CommandLine|base64offset|contains: r+, Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8060, ParentProcessName: cmd.exe, ProcessCommandLine: cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus, ProcessId: 5724, ProcessName: cscript.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: "NET" STOP AteraAgent, CommandLine: "NET" STOP AteraAgent, CommandLine|base64offset|contains: I3, Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding CACFC9F983F5284DFDC6FC6746D31D7F E Global\MSI0000, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7728, ParentProcessName: msiexec.exe, ProcessCommandLine: "NET" STOP AteraAgent, ProcessId: 7768, ProcessName: net.exe

Sigma detected: Stop Windows Service Via Net.EXE

Source: Process started

Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: "NET" STOP AteraAgent, CommandLine: "NET" STOP AteraAgent, CommandLine|base64offset|contains: I3, Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding CACFC9F983F5284DFDC6FC6746D31D7F E Global\MSI0000, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7728, ParentProcessName: msiexec.exe, ProcessCommandLine: "NET" STOP AteraAgent, ProcessId: 7768, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k smphost, CommandLine: C:\Windows\System32\svchost.exe -k smphost, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k smphost, ProcessId: 7112, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T11:16:10.007208+0100	2803305	3	Unknown Traffic	192.168.2.4	49773	13.232.67.198	443	TCP
2024-12-12T11:16:25.031959+0100	2803305	3	Unknown Traffic	192.168.2.4	49813	13.232.67.198	443	TCP
2024-12-12T11:16:30.203517+0100	2803305	3	Unknown Traffic	192.168.2.4	49832	13.232.67.198	443	TCP
2024-12-12T11:16:36.324207+0100	2803305	3	Unknown Traffic	192.168.2.4	49852	13.232.67.198	443	TCP
2024-12-12T11:16:39.208261+0100	2803305	3	Unknown Traffic	192.168.2.4	49864	13.232.67.198	443	TCP
2024-12-12T11:16:44.855086+0100	2803305	3	Unknown Traffic	192.168.2.4	49892	13.232.67.198	443	TCP
2024-12-12T11:16:45.598781+0100	2803305	3	Unknown Traffic	192.168.2.4	49895	13.232.67.198	443	TCP
2024-12-12T11:16:51.921442+0100	2803305	3	Unknown Traffic	192.168.2.4	49931	13.232.67.198	443	TCP
2024-12-12T11:16:58.269673+0100	2803305	3	Unknown Traffic	192.168.2.4	49963	13.232.67.198	443	TCP
2024-12-12T11:17:04.007381+0100	2803305	3	Unknown Traffic	192.168.2.4	49987	13.232.67.198	443	TCP
2024-12-12T11:17:17.380101+0100	2803305	3	Unknown Traffic	192.168.2.4	50022	13.232.67.198	443	TCP
2024-12-12T11:17:19.905420+0100	2803305	3	Unknown Traffic	192.168.2.4	50036	52.222.144.9	443	TCP
2024-12-12T11:17:23.927154+0100	2803305	3	Unknown Traffic	192.168.2.4	50045	52.222.144.9	443	TCP
2024-12-12T11:17:26.679462+0100	2803305	3	Unknown Traffic	192.168.2.4	50056	52.222.144.9	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Source: RQ--029.msi	Virustotal: Detection: 19%			Perma Link
Source: RQ--029.msi	ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.5% probability

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11A4BC0 CryptAcquireContextW,GetLastError,CryptReleaseContext,CryptReleaseContext,CryptReleaseContext,	37_2_00007FFDF11A4BC0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11A4DE0 CryptReleaseContext,	37_2_00007FFDF11A4DE0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11A4E20 CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptEncrypt,GetLastError,CryptDecrypt,GetLastError,CryptDestroyKey,CryptDestroyHash,	37_2_00007FFDF11A4E20

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\InstallUtil.InstallLog			Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog			Jump to behavior

Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.144.9:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.223.39.232:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.227.8.66:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.144.9:443 -> 192.168.2.4:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.144.9:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:50032 version: TLS 1.2

Source:	Binary string: D:\a\1\s\AgentPackageAgentInformation\AgentPackageAgentInformation\obj\Release\AgentPackageAgentInformation.pdb source: AgentPackageAgentInformation.exe, 00000015.00000000.2560902012.00000262141B2000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\projects\polly\src\Polly\obj\Release\netstandard1.1\Polly.pdb source: AgentPackageMonitoring.exe, 00000025.00000002.2955308908.000001A41FB02000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\CodeBases\isdev\Redist\Language Independent\i386\ISSetup.pdb source: SplashtopStreamer.exe.34.dr
Source:	Binary string: d:\slave\workspace\GIT_WIN_SRS_Formal\Source\irisserver\Release\SRUnPackFile.pdb source: SplashtopStreamer.exe.34.dr
Source:	Binary string: D:\a\1\s\AlphaControlAgentInstallation\obj\Release\AlphaControlAgentInstallation.pdb source: rundll32.exe, 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\polly\src\Polly\obj\Release\netstandard1.1\Polly.pdbSHA256 source: AgentPackageMonitoring.exe, 00000025.00000002.2955308908.000001A41FB02000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\41\s\AteraNugetPackages\Atera.AgentPackages.ModelsV3\Atera.AgentPackages.ModelsV3\obj\Release\net45\Atera.AgentPackages.ModelsV3.pdbSHA256t source: Atera.AgentPackages.ModelsV3.dll.13.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: AgentPackageAgentInformation.exe, 00000015.00000002.2610139637.000002622D2A2000.00000002.00000001.01000000.00000019.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2924444903.000002BDDC982000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\s\AlphaControlAgent\obj\Release\AteraAgent.pdb<$ source: AteraAgent.exe, 0000000C.00000000.1766473024.000001DF810F2000.00000002.00000001.01000000.0000000F.sdmp, AteraAgent.exe, 0000001B.00000002.2954879800.000001B2DFC48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: AteraAgent.exe, 0000001B.00000002.2954879800.000001B2DFC48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000015.00000002.2610139637.000002622D2A2000.00000002.00000001.01000000.00000019.sdmp, AteraAgent.exe, 0000001B.00000002.2952786726.000001B2DFA30000.00000002.00000001.01000000.00000020.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2924444903.000002BDDC982000.00000002.00000001.01000000.0000001F.sdmp, Newtonsoft.Json.dll1.13.dr, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr
Source:	Binary string: D:\a\1\s\Atera.AgentPackage.Common\obj\Release\Atera.AgentPackage.Common.pdb source: AgentPackageAgentInformation.exe, 00000015.00000002.2609275400.0000026214AE2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\41\s\AteraNugetPackages\Atera.AgentPackages.ModelsV3\Atera.AgentPackages.ModelsV3\obj\Release\net45\Atera.AgentPackages.ModelsV3.pdb source: Atera.AgentPackages.ModelsV3.dll.13.dr
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netstandard1.0\System.ValueTuple.pdb source: System.ValueTuple.dll.13.dr
Source:	Binary string: t.pdb source: AteraAgent.exe, 0000001B.00000002.2947188858.000001B2DF7E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet-private\obj\2012\System.Data.SQLite.2012\Release\System.Data.SQLite.pdbp+ source: AgentPackageMonitoring.exe, 00000025.00000002.2963387299.000001A41FED2000.00000002.00000001.01000000.00000027.sdmp, System.Data.SQLite.dll.13.dr
Source:	Binary string: C:\projects\nlog\src\NLog\obj\Release\net45\NLog.pdb source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: D:\a\1\s\AgentPackageMonitoring\AgentPackageMonitoring\obj\Release\AgentPackageMonitoring.pdb source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\wixca.pdb source: RQ--029.msi, MSI472D.tmp.1.dr
Source:	Binary string: C:\projects\structuremap\src\StructureMap\obj\Release\net45\StructureMap.pdb source: AgentPackageMonitoring.exe, 00000025.00000002.2953115262.000001A41FA62000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbP source: rundll32.exe, 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr
Source:	Binary string: C:\projects\structuremap\src\StructureMap\obj\Release\net45\StructureMap.pdbSHA256`{f source: AgentPackageMonitoring.exe, 00000025.00000002.2953115262.000001A41FA62000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\a\1\s\Atera.AgentPackage.Common\obj\Release\Atera.AgentPackage.Common.pdbPf source: AgentPackageAgentInformation.exe, 00000015.00000002.2609275400.0000026214AE2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: System.pdb source: AteraAgent.exe, 0000001B.00000002.2954879800.000001B2DFC48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: rundll32.exe, 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr
Source:	Binary string: D:\a\1\s\AlphaControlAgent\obj\Release\AteraAgent.pdb source: AteraAgent.exe, 0000000C.00000000.1766473024.000001DF810F2000.00000002.00000001.01000000.0000000F.sdmp, AteraAgent.exe, 0000001B.00000002.2954879800.000001B2DFC48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet-private\bin\2012\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: AgentPackageMonitoring.exe, 00000025.00000002.2984192827.00007FFDF12EA000.00000002.00000001.01000000.0000001C.sdmp, SQLite.Interop.dll.13.dr
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netstandard1.0\System.ValueTuple.pdbSHA256 source: System.ValueTuple.dll.13.dr
Source:	Binary string: D:\a\c-sharp\c-sharp\src\Api\PubnubApi\obj\Release\net45\Pubnub.pdbSHA256 source: AteraAgent.exe, 0000000C.00000002.1823489773.000001DF9B5C2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\c-sharp\c-sharp\src\Api\PubnubApi\obj\Release\net45\Pubnub.pdb source: AteraAgent.exe, 0000000C.00000002.1823489773.000001DF9B5C2000.00000002.00000001.01000000.00000011.sdmp, AteraAgent.exe, 0000000D.00000002.2970173077.0000015E54BC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet-private\obj\2012\System.Data.SQLite.2012\Release\System.Data.SQLite.pdb source: AgentPackageMonitoring.exe, 00000025.00000002.2963387299.000001A41FED2000.00000002.00000001.01000000.00000027.sdmp, System.Data.SQLite.dll.13.dr
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard1.1\System.Memory.pdb source: System.Memory.dll.13.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\SfxCA.pdb source: RQ--029.msi, MSI2CD9.tmp.1.dr
Source:	Binary string: /_/src/ICSharpCode.SharpZipLib/obj/Release/net45/ICSharpCode.SharpZipLib.pdbSHA256mW source: AteraAgent.exe, 0000000D.00000002.2969713270.0000015E54AB2000.00000002.00000001.01000000.00000028.sdmp, ICSharpCode.SharpZipLib.dll.1.dr
Source:	Binary string: /_/src/ICSharpCode.SharpZipLib/obj/Release/net45/ICSharpCode.SharpZipLib.pdb source: AteraAgent.exe, 0000000D.00000002.2969713270.0000015E54AB2000.00000002.00000001.01000000.00000028.sdmp, ICSharpCode.SharpZipLib.dll.1.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA2567 source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2952786726.000001B2DFA30000.00000002.00000001.01000000.00000020.sdmp, Newtonsoft.Json.dll1.13.dr, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard1.1\System.Memory.pdbSHA256 source: System.Memory.dll.13.dr
Source:	Binary string: C:\code\dapper-dot-net\Dapper\bin\Release\net45\Dapper.pdb source: AgentPackageMonitoring.exe, 00000025.00000002.2959308545.000001A41FCD2000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: C:\projects\nlog\src\NLog\obj\Release\net45\NLog.pdbSHA256d source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\cscript.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B381A44h	12_2_00007FFD9B38187E
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B381FFFh	12_2_00007FFD9B38187E
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B381FFFh	12_2_00007FFD9B381EB6
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B381FFFh	12_2_00007FFD9B381E7E
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B381FFFh	12_2_00007FFD9B381E88
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B381873h	12_2_00007FFD9B380C1D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B38227Bh	12_2_00007FFD9B380C1D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B374ECBh	13_2_00007FFD9B374E6B
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B38BDD2h	27_2_00007FFD9B38BB7E
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B374ECBh	27_2_00007FFD9B374C41
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B374ECBh	27_2_00007FFD9B374E45
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B371873h	27_2_00007FFD9B370C58
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 4x nop then jmp 00007FFD9B37227Bh	27_2_00007FFD9B370C58

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 21.0.AgentPackageAgentInformation.exe.262141b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.Utils.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe, type: DROPPED

Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=afd68752-dbb1-4629-bb7a-4b992b45f2ca&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=76d4ae57-17bf-4f80-941f-dfaec85e70ea&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=51a415c1-2b2c-4b67-8c44-1c23b5006966&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=774b77be-1c5d-40a4-aaf9-a271b56e415d&tr=31&tt=17339985209973036&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=052b3658-a246-45af-9f6e-3245310762d8&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=5b0253c2-a85c-4e9c-930f-3ee261c0dba3&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageAgentInformation/38.3/AgentPackageAgentInformation.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=4001b75e-ef93-41e1-9164-a364993824c7&tr=31&tt=17339985815665640&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=01a07f47-4407-4c38-823d-6e5cc94bf07a&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=225d0b69-c9ce-4d95-ac69-b9fe17405e9e&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=add1eec0-31bb-44fb-a0b1-c0a51d202d6e&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=12389298-6ae7-4f15-9ea9-0fb4b2954121&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=4018a521-97a9-4c1a-8864-3e5ce86fb0b4&tr=31&tt=17339985815665640&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=ad3557e3-084c-48ee-bd6c-1cfa8c684d4e&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageMonitoring/37.8/AgentPackageMonitoring.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageSTRemote/24.3/AgentPackageSTRemote.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=aeeb8ccf-6cad-4f66-be18-8ce34441b247&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=fe41fefc-5f93-4d82-ae91-b2bfdba61e15&tr=31&tt=17339985948483535&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=51a8a5d4-ca44-40cd-84d4-46bd929e2ce8&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=c49e3f86-ddea-4646-a660-d7eb89720c05&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /csrs/win HTTP/1.1Host: my.splashtop.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=7fbc5d09-98da-404d-b19a-f5bc553e8fdf&tr=31&tt=17339985948483535&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=32512929-c9c1-4979-81c7-29f6282aeeb4&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /csrs/Splashtop_Streamer_Win_DEPLOY_INSTALLER_v3.7.2.4.exe HTTP/1.1Host: download.splashtop.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=31bb936f-6d29-4437-958a-41894ec1c07b&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=a59345e3-8f8c-485b-a783-ef9be618e04a&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=bd60ea28-235d-43b9-aee1-8ff123cbf3ec&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=e3c12418-7b83-4291-816c-71960a33cc91&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=251ddf58-e932-4891-bf1a-41fcf25995e8&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=b54b0744-77ba-461d-8569-6e8a97c304cf&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=97752f74-4e58-4d15-9e8f-db1d6f8f144c&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=a1dfed27-241b-4f14-ac5c-7f603dad8ea7&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=84cc88c2-8b2d-4972-98ab-93ca822d3bc9&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=e5a579a7-c4bc-463e-9f73-b45c1d474e19&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=93bec789-cd0a-4d0a-a674-9b9877a6ea0c&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=2c1aba4a-e431-4a67-92c5-413fd16fcfc0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=09b4d2d8-8846-4ef1-b6ed-8d14f0917a88&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageUpgradeAgent/27.6/AgentPackageUpgradeAgent.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageTicketing/30.2/AgentPackageTicketing.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=4d6591bd-1bc5-4e62-8d3f-8d6db221fd28&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=c2c17224-f7a0-412d-95aa-51f8282229db&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageOsUpdates/20.9/AgentPackageOsUpdates.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.com
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=9c4570a7-328a-4212-a79a-2c397f40b099&tr=31&tt=17339985948483535&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageProgramManagement/26.3/AgentPackageProgramManagement.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.com
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageInternalPoller/23.8/AgentPackageInternalPoller.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.com

Source: Joe Sandbox View	IP Address: 13.232.67.198 13.232.67.198
Source: Joe Sandbox View	IP Address: 52.223.39.232 52.223.39.232

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49832 -> 13.232.67.198:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49773 -> 13.232.67.198:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49813 -> 13.232.67.198:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49864 -> 13.232.67.198:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49852 -> 13.232.67.198:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49892 -> 13.232.67.198:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49895 -> 13.232.67.198:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49931 -> 13.232.67.198:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49963 -> 13.232.67.198:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49987 -> 13.232.67.198:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50022 -> 13.232.67.198:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50036 -> 52.222.144.9:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50045 -> 52.222.144.9:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50056 -> 52.222.144.9:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=afd68752-dbb1-4629-bb7a-4b992b45f2ca&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=76d4ae57-17bf-4f80-941f-dfaec85e70ea&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=51a415c1-2b2c-4b67-8c44-1c23b5006966&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=774b77be-1c5d-40a4-aaf9-a271b56e415d&tr=31&tt=17339985209973036&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=052b3658-a246-45af-9f6e-3245310762d8&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=5b0253c2-a85c-4e9c-930f-3ee261c0dba3&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageAgentInformation/38.3/AgentPackageAgentInformation.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=4001b75e-ef93-41e1-9164-a364993824c7&tr=31&tt=17339985815665640&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=01a07f47-4407-4c38-823d-6e5cc94bf07a&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=225d0b69-c9ce-4d95-ac69-b9fe17405e9e&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=add1eec0-31bb-44fb-a0b1-c0a51d202d6e&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=12389298-6ae7-4f15-9ea9-0fb4b2954121&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=4018a521-97a9-4c1a-8864-3e5ce86fb0b4&tr=31&tt=17339985815665640&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=ad3557e3-084c-48ee-bd6c-1cfa8c684d4e&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageMonitoring/37.8/AgentPackageMonitoring.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageSTRemote/24.3/AgentPackageSTRemote.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=aeeb8ccf-6cad-4f66-be18-8ce34441b247&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=fe41fefc-5f93-4d82-ae91-b2bfdba61e15&tr=31&tt=17339985948483535&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=51a8a5d4-ca44-40cd-84d4-46bd929e2ce8&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=c49e3f86-ddea-4646-a660-d7eb89720c05&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /csrs/win HTTP/1.1Host: my.splashtop.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=7fbc5d09-98da-404d-b19a-f5bc553e8fdf&tr=31&tt=17339985948483535&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=32512929-c9c1-4979-81c7-29f6282aeeb4&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /csrs/Splashtop_Streamer_Win_DEPLOY_INSTALLER_v3.7.2.4.exe HTTP/1.1Host: download.splashtop.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=31bb936f-6d29-4437-958a-41894ec1c07b&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=a59345e3-8f8c-485b-a783-ef9be618e04a&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=bd60ea28-235d-43b9-aee1-8ff123cbf3ec&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=e3c12418-7b83-4291-816c-71960a33cc91&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=251ddf58-e932-4891-bf1a-41fcf25995e8&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=b54b0744-77ba-461d-8569-6e8a97c304cf&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=97752f74-4e58-4d15-9e8f-db1d6f8f144c&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=a1dfed27-241b-4f14-ac5c-7f603dad8ea7&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=84cc88c2-8b2d-4972-98ab-93ca822d3bc9&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=e5a579a7-c4bc-463e-9f73-b45c1d474e19&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=93bec789-cd0a-4d0a-a674-9b9877a6ea0c&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=2c1aba4a-e431-4a67-92c5-413fd16fcfc0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=09b4d2d8-8846-4ef1-b6ed-8d14f0917a88&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageUpgradeAgent/27.6/AgentPackageUpgradeAgent.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageTicketing/30.2/AgentPackageTicketing.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=4d6591bd-1bc5-4e62-8d3f-8d6db221fd28&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=c2c17224-f7a0-412d-95aa-51f8282229db&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Host: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageOsUpdates/20.9/AgentPackageOsUpdates.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.com
Source: global traffic	HTTP traffic detected: GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=9c4570a7-328a-4212-a79a-2c397f40b099&tr=31&tt=17339985948483535&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1Cache-Control: no-cachePragma: no-cacheContent-Type: application/jsonHost: ps.pndsn.com
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageProgramManagement/26.3/AgentPackageProgramManagement.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.com
Source: global traffic	HTTP traffic detected: GET /agentpackagesnet45/AgentPackageInternalPoller/23.8/AgentPackageInternalPoller.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1Host: ps.atera.com

Source: global traffic	DNS traffic detected: DNS query: agent-api.atera.com
Source: global traffic	DNS traffic detected: DNS query: ps.pndsn.com
Source: global traffic	DNS traffic detected: DNS query: ps.atera.com
Source: global traffic	DNS traffic detected: DNS query: my.splashtop.com
Source: global traffic	DNS traffic detected: DNS query: download.splashtop.com
Source: global traffic	DNS traffic detected: DNS query: api.nuget.org

Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BE3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTPS://PS.ATERA.COM/AGENTPACKAGESNET45/AGENTPACKAGEMONITORING/37.8/AGENTPACKAGEMONITORING.ZIP
Source: AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCBED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a6dc35606b2c6816e.awsglobalaccelerator.com
Source: AteraAgent.exe, 0000000D.00000002.2968403746.0000015E54856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/cps.html0
Source: AteraAgent.exe, 0000000D.00000002.2968403746.0000015E54856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/last.crl0G
Source: AteraAgent.exe, 0000000C.00000000.1766473024.000001DF810F2000.00000002.00000001.01000000.0000000F.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BBF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C6FCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acontrol.atera.com/
Source: rundll32.exe, 00000004.00000002.1749347665.0000000004505000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3C0A0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3C0A7000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.0000000004975000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000015.00000002.2609356829.0000026214CC1000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4DB1000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4E2B000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4D1D000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71B0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7122000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C725F000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C710C000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://agent-api.atera.com
Source: rundll32.exe, 00000004.00000002.1749347665.0000000004505000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3C0A0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.0000000004975000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000015.00000002.2609356829.0000026214CC1000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4DB1000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4E2B000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4D1D000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71B0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7122000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C725F000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C710C000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://atera-agent-api-eu.westeurope.cloudapp.azure.com
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2968403746.0000015E54856000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, Newtonsoft.Json.dll.3.dr, System.ValueTuple.dll.13.dr, Atera.AgentPackages.ModelsV3.dll.13.dr, ICSharpCode.SharpZipLib.dll.1.dr, SQLite.Interop.dll.13.dr, Newtonsoft.Json.dll.4.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B6EC000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1825116949.000001DF9B8F6000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2970173077.0000015E54BB0000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, System.ValueTuple.dll.13.dr, Atera.AgentPackages.ModelsV3.dll.13.dr, ICSharpCode.SharpZipLib.dll.1.dr, SQLite.Interop.dll.13.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B6EC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, Newtonsoft.Json.dll.3.dr, System.ValueTuple.dll.13.dr, Atera.AgentPackages.ModelsV3.dll.13.dr, ICSharpCode.SharpZipLib.dll.1.dr, SQLite.Interop.dll.13.dr, Newtonsoft.Json.dll.4.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2964905053.0000015E54720000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2968784458.0000015E5486D000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2958992188.0000015E542B0000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2970173077.0000015E54BB0000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2970173077.0000015E54BC8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000015.00000002.2610343948.000002622D3E4000.00000004.00000020.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2836087609.000001DDFD546000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2947188858.000001B2DF717000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000020.00000002.2702151687.0000023E0836E000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000020.00000003.2701300618.0000023E0836E000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000020.00000003.2699489698.0000023E0836D000.00000004.00000020.00020000.00000000.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2940815641.000002BDF5147000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, Newtonsoft.Json.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/5
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2968403746.0000015E54856000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, Newtonsoft.Json.dll.3.dr, System.ValueTuple.dll.13.dr, Atera.AgentPackages.ModelsV3.dll.13.dr, ICSharpCode.SharpZipLib.dll.1.dr, SQLite.Interop.dll.13.dr, Newtonsoft.Json.dll.4.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: AteraAgent.exe, 0000000D.00000002.2958992188.0000015E542F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl
Source: AteraAgent.exe, 0000000C.00000002.1823734290.000001DF9B6B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl02
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B6EC000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1825116949.000001DF9B8F6000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2970173077.0000015E54BB0000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, System.ValueTuple.dll.13.dr, Atera.AgentPackages.ModelsV3.dll.13.dr, ICSharpCode.SharpZipLib.dll.1.dr, SQLite.Interop.dll.13.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B6EC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, Newtonsoft.Json.dll.3.dr, System.ValueTuple.dll.13.dr, Atera.AgentPackages.ModelsV3.dll.13.dr, ICSharpCode.SharpZipLib.dll.1.dr, SQLite.Interop.dll.13.dr, Newtonsoft.Json.dll.4.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B6EC000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B71A000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1823734290.000001DF9B6B0000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2962842731.0000015E54693000.00000004.00000020.00020000.00000000.sdmp, BA74182F76F15A9CF514DEF352303C950.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: SplashtopStreamer.exe.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: AteraAgent.exe, 0000000C.00000002.1823734290.000001DF9B6B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crlL
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crlv
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B78E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com:80/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crlche
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B78E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com:80/DigiCertTrustedRootG4.crl
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AteraAgent.exe, 0000000D.00000002.2958992188.0000015E542F7000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2970173077.0000015E54BB0000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2962842731.0000015E54702000.00000004.00000020.00020000.00000000.sdmp, 329B6147266C1E26CD774EA22B79EC2E0.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B6EC000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1825116949.000001DF9B8F6000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2970173077.0000015E54BB0000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, System.ValueTuple.dll.13.dr, Atera.AgentPackages.ModelsV3.dll.13.dr, ICSharpCode.SharpZipLib.dll.1.dr, SQLite.Interop.dll.13.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: AteraAgent.exe, 0000000D.00000002.2958992188.0000015E542F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl4
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B78E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crlm
Source: AteraAgent.exe, 0000000D.00000002.2962842731.0000015E54702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crlx
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/l
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AteraAgent.exe, 0000000D.00000002.2962842731.0000015E546DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com:80/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B78E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com:80/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crlrlCache
Source: AteraAgent.exe, 0000000D.00000002.2962842731.0000015E54693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.12.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: AteraAgent.exe, 0000000D.00000002.2962842731.0000015E546DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enduler
Source: AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCC28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://d17kmd0va0f0mp.cloudfront.net
Source: AgentPackageAgentInformation.exe, 00000015.00000000.2560902012.00000262141B2000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://dl.google.com/googletalk/googletalk-setup.exe
Source: AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCC28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.splashtop.com
Source: Newtonsoft.Json.dll.4.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: rundll32.exe, 00000011.00000002.1883870766.00000000070D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCBED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://my.splashtop.com
Source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://nlog-project.org/dummynamespace/
Source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://nlog-project.org/ws/
Source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://nlog-project.org/ws/3
Source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://nlog-project.org/ws/5
Source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://nlog-project.org/ws/ILogReceiverOneWayServer/ProcessLogMessages
Source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://nlog-project.org/ws/ILogReceiverServer/ProcessLogMessagesResponsep
Source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://nlog-project.org/ws/ILogReceiverServer/ProcessLogMessagesT
Source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://nlog-project.org/ws/T
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B71A000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2962842731.0000015E54702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/
Source: AteraAgent.exe, 0000000D.00000002.2962842731.0000015E54702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rh
Source: AteraAgent.exe, 0000000D.00000002.2967065022.0000015E54815000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2962842731.0000015E54693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxX
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/crt
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B6EC000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1825116949.000001DF9B8F6000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2970173077.0000015E54BB0000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, System.ValueTuple.dll.13.dr, Atera.AgentPackages.ModelsV3.dll.13.dr, ICSharpCode.SharpZipLib.dll.1.dr, SQLite.Interop.dll.13.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2964905053.0000015E54720000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2968784458.0000015E5486D000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2958992188.0000015E542B0000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2970173077.0000015E54BB0000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2970173077.0000015E54BC8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000015.00000002.2610343948.000002622D3E4000.00000004.00000020.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2836087609.000001DDFD546000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2947188858.000001B2DF717000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000020.00000002.2702151687.0000023E0836E000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000020.00000003.2701300618.0000023E0836E000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000020.00000003.2699489698.0000023E0836D000.00000004.00000020.00020000.00000000.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2940815641.000002BDF5147000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, Newtonsoft.Json.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2968403746.0000015E54856000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, Newtonsoft.Json.dll.3.dr, System.ValueTuple.dll.13.dr, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, Atera.AgentPackages.ModelsV3.dll.13.dr, MSI472D.tmp.1.dr, ICSharpCode.SharpZipLib.dll.1.dr, SQLite.Interop.dll.13.dr, Newtonsoft.Json.dll.4.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll.3.dr, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr, Newtonsoft.Json.dll.4.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B6EC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, Newtonsoft.Json.dll.3.dr, System.ValueTuple.dll.13.dr, Atera.AgentPackages.ModelsV3.dll.13.dr, ICSharpCode.SharpZipLib.dll.1.dr, SQLite.Interop.dll.13.dr, Newtonsoft.Json.dll.4.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com:80/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF
Source: AteraAgent.exe, 0000000C.00000002.1823734290.000001DF9B6B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com:80/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7Nfjgt
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertAssuredIDRootCA.crl_
Source: AteraAgent.exe, 0000000D.00000002.2962842731.0000015E54680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.cr
Source: AteraAgent.exe, 0000000D.00000002.2962842731.0000015E546DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3C417000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3C48B000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71F0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ps.pndsn.com
Source: AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org
Source: AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceProcess
Source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: rundll32.exe, 00000004.00000002.1749347665.00000000044E4000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1749347665.0000000004441000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BBF1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.0000000004954000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.00000000048B1000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000015.00000002.2609356829.0000026214BB3000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4DE3000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4B71000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C6FE2000.00000004.00000800.00020000.00000000.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCB61000.00000004.00000800.00020000.00000000.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr	String found in binary or memory: http://wixtoolset.org
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr	String found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr	String found in binary or memory: http://wixtoolset.org/news/
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr	String found in binary or memory: http://wixtoolset.org/releases/
Source: AgentPackageMonitoring.exe, 00000025.00000002.2954222644.000001A41FAB2000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: http://www.abit.com.tw/
Source: AteraAgent.exe, 0000000D.00000002.2962842731.0000015E546DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B6EC000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1825116949.000001DF9B8F6000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2970173077.0000015E54BB0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Newtonsoft.Json.dll1.13.dr, System.Memory.dll.13.dr, System.Data.SQLite.dll.13.dr, Newtonsoft.Json.dll.3.dr, System.ValueTuple.dll.13.dr, Atera.AgentPackages.ModelsV3.dll.13.dr, ICSharpCode.SharpZipLib.dll.1.dr, SQLite.Interop.dll.13.dr, Newtonsoft.Json.dll.4.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SplashtopStreamer.exe.34.dr	String found in binary or memory: http://www.flexerasoftware.com0
Source: rundll32.exe, 00000011.00000002.1883870766.00000000070D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.oh
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.P
Source: rundll32.exe, 00000004.00000002.1749347665.00000000044E4000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.0000000004954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.aterD
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7095000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70D6000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C6FE2000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7122000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C710C000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71C4000.00000004.00000800.00020000.00000000.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1749347665.00000000044E4000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1749347665.0000000004441000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.0000000004954000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.00000000048B1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C6FE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Pro
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C6FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Productio
Source: AgentPackageAgentInformation.exe, 00000015.00000002.2609356829.0000026214BB3000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4C05000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4D1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1749347665.00000000044E4000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1749347665.0000000004441000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.0000000004954000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.00000000048B1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BEBF000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3C0A7000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/AgentStarting
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/AgentStarting)
Source: AgentPackageAgentInformation.exe, 00000015.00000002.2609356829.0000026214BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/CommandResult
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BE6E000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7095000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/GetCommands
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/GetCommands)
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3C0A0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BE6E000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71B0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7122000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C710C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/GetCommandsFallback
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7122000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/GetCommandsFallback)
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/GetCommandsFallback0
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C6FE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/GetEnvironmentStatus
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7095000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C6FE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/GetRecurringPackages
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/dynamic-fields/
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4DE3000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/dynamic-fields/script-based
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4C05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/guiCommandResult
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4DB1000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4D1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/recurringCommandResult
Source: AgentPackageMonitoring.exe, 00000025.00000002.2966226201.000001A420CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/thresholds/1421
Source: AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/thresholds/14216fa6-dc15-4519-acf9-f0e1b34954b6
Source: rundll32.exe, 00000004.00000002.1749347665.00000000044E4000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1749347665.0000000004441000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.0000000004954000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.00000000048B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/track-event
Source: rundll32.exe, 00000004.00000002.1749347665.0000000004526000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.0000000004996000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/Production/Agent/track-event;
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agent-api.atera.com/ProductionPl3
Source: AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCC13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://download.splashtop.com
Source: AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCC13000.00000004.00000800.00020000.00000000.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCC0F000.00000004.00000800.00020000.00000000.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCBED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://download.splashtop.com/csrs/Splashtop_Streamer_Win_DEPLOY_INSTALLER_v3.7.2.4.exe
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000015.00000002.2610139637.000002622D2A2000.00000002.00000001.01000000.00000019.sdmp, AteraAgent.exe, 0000001B.00000002.2952786726.000001B2DFA30000.00000002.00000001.01000000.00000020.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2924444903.000002BDDC982000.00000002.00000001.01000000.0000001F.sdmp, Newtonsoft.Json.dll1.13.dr, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: System.ValueTuple.dll.13.dr	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf
Source: System.ValueTuple.dll.13.dr	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8
Source: System.Memory.dll.13.dr	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
Source: System.Memory.dll.13.dr	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
Source: AteraAgent.exe, 0000000D.00000002.2969713270.0000015E54AB2000.00000002.00000001.01000000.00000028.sdmp, ICSharpCode.SharpZipLib.dll.1.dr	String found in binary or memory: https://github.com/icsharpcode/SharpZipLib
Source: AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCBE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.splashtop.com
Source: AgentPackageSTRemote.exe, 00000022.00000000.2669697402.000002BDDBED2000.00000002.00000001.01000000.0000001A.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCB61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.splashtop.com/csrs/win
Source: AgentPackageMonitoring.exe, 00000025.00000002.2963004181.000001A41FE08000.00000002.00000001.01000000.00000025.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: https://nlog-project.org/
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: https://packagesstore.blob.core.windows.net/installers/BitDefender/rmm.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BE3D000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagescrossplatform/AgentPackageMonitoring/0.40/AgentPackageMonitoring.z
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagescrossplatform/AgentPackageSTRemote/2.6/AgentPackageSTRemote.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/Agen
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCB8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/Agent.Package.Availability/0.16/Agent.Package.Availability.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BC5E000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCB8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCCC000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCDC000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/Agent.Package.IotPoc/0.2/Agent.Package.IotPoc.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCB8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/Agent.Package.Watchdog/1.9/Agent.Package.Watchdog.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageADRemote/6.0/AgentPackageADRemote.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageAgentInformation/38.3/AgentPackageAgentInformation
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageHeartbeat/17.11/AgentPackageHeartbeat.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageInternalPoller/13.0/AgentPackageInternalPoller.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageMarketplace/1.6/AgentPackageMarketplace.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BC5E000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageMonitoring/37.8/AgentPackageMonitoring.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCCC000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageNetworkDiscovery/13.0/AgentPackageNetworkDiscovery
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageOsUpdates/20.9/AgentPackageOsUpdates.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageProgramManagement/26.3/AgentPackageProgramManageme
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageRuntimeInstaller/1.5/AgentPackageRuntimeInstaller.
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageSTRemote/24.3/AgentPackageSTRemote.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageSystemTools/27.10/AgentPackageSystemTools.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageTaskScheduler/13.0/AgentPackageTaskScheduler.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageTicketing/13.0/AgentPackageTicketing.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageUpgradeAgent/27.6/AgentPackageUpgradeAgent.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesmac/AgentPackageWindowsUpdate/24.6/AgentPackageWindowsUpdate.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCB8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/Agent.Package.Availability/0.16/Agent.Package.Availability.z
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BC5E000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCB8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCCC000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCDC000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/Agent.Package.IotPoc/0.2/Agent.Package.IotPoc.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCB8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/Agent.Package.Watchdog/1.9/Agent.Package.Watchdog.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageADRemote/6.0/AgentPackageADRemote.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageAgentInformation/38.3/AgentPackageAgentInformati
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageHeartbeat/17.14/AgentPackageHeartbeat.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageInternalPoller/23.8/AgentPackageInternalPoller.z
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageMarketplace/1.6/AgentPackageMarketplace.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageMonitoring/37.8/AgentPackageMonitoring.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BE3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageMonitoring/37.8/AgentPackageMonitoring.zip?JAAaE
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCB8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCCC000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageNetworkDiscovery/23.9/AgentPackageNetworkDiscove
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageOsUpdates/20.9/AgentPackageOsUpdates.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageProgramManagement/26.3/AgentPackageProgramManage
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageRuntimeInstaller/1.6/AgentPackageRuntimeInstalle
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageSTRemote/24.3/AgentPackageSTRemote.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageSystemTools/27.10/AgentPackageSystemTools.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageTaskScheduler/17.2/AgentPackageTaskScheduler.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageTicketing/30.2/AgentPackageTicketing.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageTicketing/30.2/AgentPackageTicketing.zipX
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageUpgradeAgent/27.6/AgentPackageUpgradeAgent.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackagesnet45/AgentPackageWindowsUpdate/24.6/AgentPackageWindowsUpdate.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCB8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/Agent.Package.Availability/13.0/Agent.Package.Availability.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BC5E000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCB8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCCC000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCDC000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/Agent.Package.IotPoc/13.0/Agent.Package.IotPoc.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCB8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/Agent.Package.Watchdog/13.0/Agent.Package.Watchdog.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BC5E000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPacka
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageADRemote/1.2/AgentPackageADRemote.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageAgentInformation/22.7/AgentPackageAgentInformation
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageHeartbeat/16.9/AgentPackageHeartbeat.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageInternalPoller/15.9/AgentPackageInternalPoller.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageMarketplace/13.0/AgentPackageMarketplace.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BC5E000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageMonitoring/22.0/AgentPackageMonitoring.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageNetworkDiscovery/15.0/AgentPackageNetworkDiscovery
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageOsUpdates/1.0/AgentPackageOsUpdates.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageProgramManagement/15.5/AgentPackageProgramManageme
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageRuntimeInstaller/13.0/AgentPackageRuntimeInstaller
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageSTRemote/16.0/AgentPackageSTRemote.zip
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageSTRemote/16.0xK
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageSystemTools/18.9/AgentPackageSystemTools.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageTaskScheduler/13.1/AgentPackageTaskScheduler.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageTicketing/18.9/AgentPackageTicketing.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageUpgradeAgent/22.1/AgentPackageUpgradeAgent.zip
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/agentpackageswin/AgentPackageWindowsUpdate/18.3/AgentPackageWindowsUpdate.zip
Source: AgentPackageSTRemote.exe, 00000022.00000000.2669697402.000002BDDBED2000.00000002.00000001.01000000.0000001A.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCB61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.atera.com/installers/splashtop/win/SplashtopStreamer.exe
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7102000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71F6000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71F0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3C487000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3C417000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCDC000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71F6000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71F0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C710C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=01a07f47-4407-4c38-823d-6e5cc94bf07a
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BEBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=09b4d2d8-8846-4ef1-b6ed-8d14f0917a88
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=32512929-c9c1-4979-81c7-29f6282aeeb4
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=51a415c1-2b2c-4b67-8c44-1c23b5006966
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=51a8a5d4-ca44-40cd-84d4-46bd929e2ce8
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=e5a579a7-c4bc-463e-9f73-b45c1d474e19
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/v2/presence/sub_key
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3C48B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channe
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3C48B000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7185000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/v2/subscrib
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C710C000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9
Source: AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4p
Source: AgentPackageMonitoring.exe, 00000025.00000002.2963387299.000001A41FED2000.00000002.00000001.01000000.00000027.sdmp, System.Data.SQLite.dll.13.dr	String found in binary or memory: https://system.data.sqlite.org/
Source: AgentPackageMonitoring.exe, 00000025.00000002.2964470827.000001A41FF34000.00000002.00000001.01000000.00000027.sdmp, System.Data.SQLite.dll.13.dr	String found in binary or memory: https://system.data.sqlite.org/X
Source: System.Data.SQLite.dll.13.dr	String found in binary or memory: https://urn.to/r/sds_see
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr, SplashtopStreamer.exe.34.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr	String found in binary or memory: https://www.newtonsoft.com/json
Source: Newtonsoft.Json.dll.4.dr	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: AgentPackageMonitoring.exe, 00000025.00000002.2963004181.000001A41FE08000.00000002.00000001.01000000.00000025.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: https://www.nuget.org/packages/NLog.Web.AspNetCore
Source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000015.00000002.2610139637.000002622D2A2000.00000002.00000001.01000000.00000019.sdmp, AteraAgent.exe, 0000001B.00000002.2952786726.000001B2DFA30000.00000002.00000001.01000000.00000020.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2924444903.000002BDDC982000.00000002.00000001.01000000.0000001F.sdmp, Newtonsoft.Json.dll1.13.dr, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: AgentPackageMonitoring.exe	String found in binary or memory: https://www.sqlite.org/copyright.html
Source: AgentPackageMonitoring.exe, 00000025.00000002.2984783241.00007FFDF1334000.00000002.00000001.01000000.0000001C.sdmp, SQLite.Interop.dll.13.dr	String found in binary or memory: https://www.sqlite.org/copyright.html2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.144.9:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.223.39.232:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.227.8.66:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.144.9:443 -> 192.168.2.4:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.144.9:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.232.67.198:443 -> 192.168.2.4:50032 version: TLS 1.2

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BA74182F76F15A9CF514DEF352303C95	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\AteraAgent	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5323c0.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI25B4.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2CD9.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI438F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{E732A0D7-A2F2-4657-AC41-B19742648E45}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4584.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4594.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4603.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI472D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5323c2.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5323c2.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI619B.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\AlphaControlAgentInstallation.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\Newtonsoft.Json.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\System.Management.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\CustomAction.config	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\AlphaControlAgentInstallation.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\Newtonsoft.Json.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\System.Management.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\CustomAction.config	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\AlphaControlAgentInstallation.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\Newtonsoft.Json.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\System.Management.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\CustomAction.config	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\InstallUtil.InstallLog	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BA74182F76F15A9CF514DEF352303C95
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\329B6147266C1E26CD774EA22B79EC2E
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\AlphaControlAgentInstallation.dll
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\Newtonsoft.Json.dll
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\System.Management.dll
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\CustomAction.config
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageAgentInformation.exe.log

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI25B4.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_068E0040	4_3_068E0040
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_04C250B8	5_3_04C250B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_04C259A8	5_3_04C259A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_04C24D68	5_3_04C24D68
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 12_2_00007FFD9B38C922	12_2_00007FFD9B38C922
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 12_2_00007FFD9B38BB76	12_2_00007FFD9B38BB76
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 12_2_00007FFD9B380C1D	12_2_00007FFD9B380C1D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 13_2_00007FFD9B589E9D	13_2_00007FFD9B589E9D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 13_2_00007FFD9B58AD61	13_2_00007FFD9B58AD61
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 13_2_00007FFD9B586950	13_2_00007FFD9B586950
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_3_04800040	17_3_04800040
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_3_048071D0	17_3_048071D0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B3811BD	21_2_00007FFD9B3811BD
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B371953	21_2_00007FFD9B371953
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B377956	21_2_00007FFD9B377956
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B382118	21_2_00007FFD9B382118
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B378702	21_2_00007FFD9B378702
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B39057D	21_2_00007FFD9B39057D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B3712FB	21_2_00007FFD9B3712FB
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B3811D3	21_2_00007FFD9B3811D3
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B380ED8	21_2_00007FFD9B380ED8
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B3716FA	21_2_00007FFD9B3716FA
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B380E3C	21_2_00007FFD9B380E3C
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3A8976	23_2_00007FFD9B3A8976
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3A1953	23_2_00007FFD9B3A1953
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3A12FB	23_2_00007FFD9B3A12FB
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3CE1D4	23_2_00007FFD9B3CE1D4
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3AD0F9	23_2_00007FFD9B3AD0F9
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3A4118	23_2_00007FFD9B3A4118
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3A9722	23_2_00007FFD9B3A9722
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3AC4D1	23_2_00007FFD9B3AC4D1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3C04F0	23_2_00007FFD9B3C04F0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3A3BF3	23_2_00007FFD9B3A3BF3
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3A0EFA	23_2_00007FFD9B3A0EFA
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3B5CDD	23_2_00007FFD9B3B5CDD
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3D131D	23_2_00007FFD9B3D131D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3A0730	23_2_00007FFD9B3A0730
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3A16FA	23_2_00007FFD9B3A16FA
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 25_2_00007FFD9B3A1953	25_2_00007FFD9B3A1953
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 25_2_00007FFD9B3A0EFA	25_2_00007FFD9B3A0EFA
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 25_2_00007FFD9B3A16FA	25_2_00007FFD9B3A16FA
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 25_2_00007FFD9B3A12FB	25_2_00007FFD9B3A12FB
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B392043	27_2_00007FFD9B392043
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B38CE90	27_2_00007FFD9B38CE90
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B379EDF	27_2_00007FFD9B379EDF
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B38CD70	27_2_00007FFD9B38CD70
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B381D8B	27_2_00007FFD9B381D8B
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B393CC0	27_2_00007FFD9B393CC0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B38D3B8	27_2_00007FFD9B38D3B8
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B380338	27_2_00007FFD9B380338
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B37EA28	27_2_00007FFD9B37EA28
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B395218	27_2_00007FFD9B395218
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B38CE20	27_2_00007FFD9B38CE20
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B589E9D	27_2_00007FFD9B589E9D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B589267	27_2_00007FFD9B589267
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B586950	27_2_00007FFD9B586950
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B58AE3D	27_2_00007FFD9B58AE3D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B370C58	27_2_00007FFD9B370C58
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B3717A0	34_2_00007FFD9B3717A0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B3766D8	34_2_00007FFD9B3766D8
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B38174D	34_2_00007FFD9B38174D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B373568	34_2_00007FFD9B373568
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B392CA0	34_2_00007FFD9B392CA0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B3884C0	34_2_00007FFD9B3884C0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B391C26	34_2_00007FFD9B391C26
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B385288	34_2_00007FFD9B385288
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B385318	34_2_00007FFD9B385318
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF121B880	37_2_00007FFDF121B880
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12D01E0	37_2_00007FFDF12D01E0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12C20E0	37_2_00007FFDF12C20E0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12C6960	37_2_00007FFDF12C6960
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1229170	37_2_00007FFDF1229170
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11911B0	37_2_00007FFDF11911B0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11FF1B0	37_2_00007FFDF11FF1B0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12A3200	37_2_00007FFDF12A3200
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF120F220	37_2_00007FFDF120F220
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12C50F0	37_2_00007FFDF12C50F0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF122B370	37_2_00007FFDF122B370
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11B93D0	37_2_00007FFDF11B93D0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF126F3E0	37_2_00007FFDF126F3E0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF119D284	37_2_00007FFDF119D284
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF122D350	37_2_00007FFDF122D350
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF119F340	37_2_00007FFDF119F340
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12755F0	37_2_00007FFDF12755F0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11FB647	37_2_00007FFDF11FB647
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11A5640	37_2_00007FFDF11A5640
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11DF630	37_2_00007FFDF11DF630
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF119D634	37_2_00007FFDF119D634
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1193474	37_2_00007FFDF1193474
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11974B0	37_2_00007FFDF11974B0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF119955C	37_2_00007FFDF119955C
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11EF780	37_2_00007FFDF11EF780
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12DF790	37_2_00007FFDF12DF790
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11DD770	37_2_00007FFDF11DD770
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF124B7C0	37_2_00007FFDF124B7C0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12E1840	37_2_00007FFDF12E1840
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11AD830	37_2_00007FFDF11AD830
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1231690	37_2_00007FFDF1231690
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12856D0	37_2_00007FFDF12856D0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12036E0	37_2_00007FFDF12036E0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1237720	37_2_00007FFDF1237720
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11FB9F0	37_2_00007FFDF11FB9F0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11F18DA	37_2_00007FFDF11F18DA
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11BD910	37_2_00007FFDF11BD910
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF127DB80	37_2_00007FFDF127DB80
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11D9BA0	37_2_00007FFDF11D9BA0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11BBBE0	37_2_00007FFDF11BBBE0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12D3C20	37_2_00007FFDF12D3C20
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11C9A60	37_2_00007FFDF11C9A60
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11C5AD0	37_2_00007FFDF11C5AD0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1233AF0	37_2_00007FFDF1233AF0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11F7B30	37_2_00007FFDF11F7B30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11C3E10	37_2_00007FFDF11C3E10
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11A5E50	37_2_00007FFDF11A5E50
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF127BCD0	37_2_00007FFDF127BCD0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF126DCC0	37_2_00007FFDF126DCC0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11D9CF0	37_2_00007FFDF11D9CF0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11D7E70	37_2_00007FFDF11D7E70
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF122FED0	37_2_00007FFDF122FED0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1197EC0	37_2_00007FFDF1197EC0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1213EB0	37_2_00007FFDF1213EB0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1237EA0	37_2_00007FFDF1237EA0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11EFEF0	37_2_00007FFDF11EFEF0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1225F20	37_2_00007FFDF1225F20
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11A7F30	37_2_00007FFDF11A7F30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11C9F30	37_2_00007FFDF11C9F30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1202240	37_2_00007FFDF1202240
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF124C220	37_2_00007FFDF124C220
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF122A0C0	37_2_00007FFDF122A0C0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12340A0	37_2_00007FFDF12340A0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF121C110	37_2_00007FFDF121C110
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12322B0	37_2_00007FFDF12322B0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1258310	37_2_00007FFDF1258310
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11B2310	37_2_00007FFDF11B2310
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF123A2F0	37_2_00007FFDF123A2F0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11B0330	37_2_00007FFDF11B0330
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1276590	37_2_00007FFDF1276590
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF124E590	37_2_00007FFDF124E590
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12B05D0	37_2_00007FFDF12B05D0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11985D4	37_2_00007FFDF11985D4
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12CE5B0	37_2_00007FFDF12CE5B0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1210600	37_2_00007FFDF1210600
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11A44DC	37_2_00007FFDF11A44DC
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11F64A0	37_2_00007FFDF11F64A0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11E0510	37_2_00007FFDF11E0510
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1214550	37_2_00007FFDF1214550
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF119A524	37_2_00007FFDF119A524
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF119E80C	37_2_00007FFDF119E80C
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF122A7E0	37_2_00007FFDF122A7E0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12CC680	37_2_00007FFDF12CC680
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11AE720	37_2_00007FFDF11AE720
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11A2738	37_2_00007FFDF11A2738
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11EE990	37_2_00007FFDF11EE990
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1198A3C	37_2_00007FFDF1198A3C
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11A8860	37_2_00007FFDF11A8860
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1256860	37_2_00007FFDF1256860
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11928C0	37_2_00007FFDF11928C0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11E88A0	37_2_00007FFDF11E88A0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1286910	37_2_00007FFDF1286910
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11E8B90	37_2_00007FFDF11E8B90
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF123CC00	37_2_00007FFDF123CC00
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11B6A80	37_2_00007FFDF11B6A80
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF125AA70	37_2_00007FFDF125AA70
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11D8A60	37_2_00007FFDF11D8A60
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF127AB00	37_2_00007FFDF127AB00
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF120CB50	37_2_00007FFDF120CB50
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12CCD60	37_2_00007FFDF12CCD60
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1194DB4	37_2_00007FFDF1194DB4
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11F0E30	37_2_00007FFDF11F0E30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12C4C80	37_2_00007FFDF12C4C80
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11A6CC0	37_2_00007FFDF11A6CC0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11DACD0	37_2_00007FFDF11DACD0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1204D00	37_2_00007FFDF1204D00
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF12E0D30	37_2_00007FFDF12E0D30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1216D20	37_2_00007FFDF1216D20
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1258D20	37_2_00007FFDF1258D20
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11A2F8C	37_2_00007FFDF11A2F8C
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF122EFD0	37_2_00007FFDF122EFD0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11DAFB0	37_2_00007FFDF11DAFB0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11D9020	37_2_00007FFDF11D9020
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11BCE70	37_2_00007FFDF11BCE70
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF119CEA8	37_2_00007FFDF119CEA8
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF1274EE0	37_2_00007FFDF1274EE0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B36BD61	37_2_00007FFD9B36BD61
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B365D0F	37_2_00007FFD9B365D0F
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B36D126	37_2_00007FFD9B36D126
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B5832A6	37_2_00007FFD9B5832A6
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B582BCF	37_2_00007FFD9B582BCF
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B693C71	37_2_00007FFD9B693C71
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B694D17	37_2_00007FFD9B694D17
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B689779	37_2_00007FFD9B689779
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B690CB0	37_2_00007FFD9B690CB0
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B7535A4	37_2_00007FFD9B7535A4
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B750B77	37_2_00007FFD9B750B77
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B769A58	37_2_00007FFD9B769A58
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B7632DC	37_2_00007FFD9B7632DC

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe A96A0BA7998A6956C8073B6EFF9306398CC03FB9866E4CABF0810A69BB2A43B2
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll 443A1C088E62810A954FFE9F0136F7A8D5E44928425D23B5284D936270D9837A

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: String function: 00007FFDF12E1B70 appears 102 times
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: String function: 00007FFDF12E1D30 appears 114 times
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: String function: 00007FFDF12E06B0 appears 146 times

Source: RQ--029.msi	Binary or memory string: OriginalFilenameAlphaControlAgentInstallation.dll\ vs RQ--029.msi
Source: RQ--029.msi	Binary or memory string: OriginalFilenameSfxCA.dll\ vs RQ--029.msi
Source: RQ--029.msi	Binary or memory string: OriginalFilenamewixca.dll\ vs RQ--029.msi

Source: ICSharpCode.SharpZipLib.dll.1.dr, InflaterInputBuffer.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.1.dr, DeflaterOutputStream.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.1.dr, ZipAESTransform.cs	Cryptographic APIs: 'TransformBlock'

Source: AteraAgent.exe.1.dr, SignatureValidator.cs

Base64 encoded string: 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0YmxeR/2wifvwd/MQXb/5tsLsvlMs50tmraklX8MKsU1EgEpRZ+W0Ro1ZHoLhQG53oq9hPz9bmJge78yZr6l1QJWz6wCj+yQUxM5f0gt4fHEf2yA94Tklnds7JPr2vQRb5rjAnxnt7722oWFc1bxFFsIcIhOI/EHYCE0qSPE1pKMXALkHZYoDQEFUu3YgEc0Oo7ClJNFrB75g6tVZRqGKxVvYQBb9zKDxhBRnDkhZuB7D1gRaR9PNwCr7tVtPt40c+CCf5ktUkeu4JzaiEipWvKYgRvotqsFtZF5uFso2UmdvxO+lIw9i/GPDfgS4JhKu/Y9lCuaan+xEluhSK0vpQIDAQAB'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winMSI@54/125@15/4

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\ATERA Networks

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6540:120:WilError_03
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Mutant created: NULL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DFBDF63F9E0954AA6F.TMP

Jump to behavior

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "AteraAgent.exe")
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Name from Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Name from Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Name from Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select MaxClockSpeed from Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

File read: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.ini

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI25B4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5449250 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId

Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: SELECT Identifier, Severity, Timestamp FROM ThresholdDuration WHERE Identifier = @id;kDELETE FROM ThresholdDuration WHERE Identifier = @id;
Source: AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS AlertedEvents_V2 (Id INTEGER PRIMARY KEY, Timestamp BIGINT NOT NULL, LogName TEXT NOT NULL, Severity INTEGER NOT NULL, RecordId BIGINT NOT NULL, EventId BIGINT NOT NULL, Source TEXT NOT NULL, Message TEXT NULL); CREATE INDEX IF NOT EXISTS idx_AlertedEvents_V2_Timestamp ON AlertedEvents_V2 (Timestamp); CREATE INDEX IF NOT EXISTS idx_AlertedEvents_V2_LogName ON AlertedEvents_V2 (LogName);@X9
Source: AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS ThresholdsProfiles (Id INTEGER NOT NULL PRIMARY KEY,IsActive BOOLEAN NOT NULL,Timestamp BIGINT NOT NULL,Name TEXT NOT NULL,Thresholds TEXT NOT NULL); CREATE INDEX IF NOT EXISTS idx_ThresholdsProfiles_Timestamp ON ThresholdsProfiles (Timestamp);@X9
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: INSERT INTO ThresholdDuration (Identifier,Severity,Timestamp) Values (@identifier, @severity, @timestamp) ON CONFLICT (Identifier) DO UPDATE SET Severity = excluded.Severity, Timestamp = excluded.Timestamp;
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: INSERT INTO [AlertsSent] (Timestamp, Alerts) VALUES (@timestamp, @alerts);kExecuteScriptAsync SystemTools Start scriptGuid : {0}Wrunscriptguid {0} 10 W10= disableSendResult
Source: AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A407927000.00000004.00000800.00020000.00000000.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS AlertedEvents_V2 (Id INTEGER PRIMARY KEY, Timestamp BIGINT NOT NULL, LogName TEXT NOT NULL, Severity INTEGER NOT NULL, RecordId BIGINT NOT NULL, EventId BIGINT NOT NULL, Source TEXT NOT NULL, Message TEXT NULL); CREATE INDEX IF NOT EXISTS idx_AlertedEvents_V2_Timestamp ON AlertedEvents_V2 (Timestamp); CREATE INDEX IF NOT EXISTS idx_AlertedEvents_V2_LogName ON AlertedEvents_V2 (LogName);
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS StatisticsSendTime (Id INTEGER PRIMARY KEY,Timestamp BIGINT NOT NULL);
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: INSERT INTO Statistics(Name, Timestamp, Value) Values (@name, @timestamp, @value);%StatisticsSendTime
Source: AgentPackageMonitoring.exe, AgentPackageMonitoring.exe, 00000025.00000002.2984192827.00007FFDF12EA000.00000002.00000001.01000000.0000001C.sdmp, SQLite.Interop.dll.13.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS ThresholdDuration (Id INTEGER PRIMARY KEY,Identifier TEXT NOT NULL,Severity TEXT NOT NULL,Timestamp BIGINT NOT NULL); CREATE UNIQUE INDEX IF NOT EXISTS idx_ThresholdDuration_Identifier ON ThresholdDuration (Identifier);
Source: SplashtopStreamer.exe.34.dr	Binary or memory string: SELECT Feature_ FROM ISSetupTypeFeatures WHERE ISSetupType_ = '%s'SetupType.cppsysnativesyswow64SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs[Win32]SharedFiles.cpp;Page UpPage DownEndHomeLeftUpRightDownInsertNum *Num /Num +Num -
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS Stub (Id INTEGER PRIMARY KEY, Timestamp BIGINT NOT NULL);
Source: AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS Statistics (Id INTEGER PRIMARY KEY,Name TEXT NOT NULL,Timestamp BIGINT NOT NULL,Value TEXT NOT NULL);
Source: AgentPackageMonitoring.exe, 00000025.00000002.2984192827.00007FFDF12EA000.00000002.00000001.01000000.0000001C.sdmp, SQLite.Interop.dll.13.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS ThresholdsProfiles (Id INTEGER NOT NULL PRIMARY KEY,IsActive BOOLEAN NOT NULL,Timestamp BIGINT NOT NULL,Name TEXT NOT NULL,Thresholds TEXT NOT NULL);
Source: AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS ThresholdDuration (Id INTEGER PRIMARY KEY,Identifier TEXT NOT NULL,Severity TEXT NOT NULL,Timestamp BIGINT NOT NULL); CREATE UNIQUE INDEX IF NOT EXISTS idx_ThresholdDuration_Identifier ON ThresholdDuration (Identifier);@X9
Source: AgentPackageMonitoring.exe, AgentPackageMonitoring.exe, 00000025.00000002.2984192827.00007FFDF12EA000.00000002.00000001.01000000.0000001C.sdmp, SQLite.Interop.dll.13.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: AgentPackageMonitoring.exe, AgentPackageMonitoring.exe, 00000025.00000002.2984192827.00007FFDF12EA000.00000002.00000001.01000000.0000001C.sdmp, SQLite.Interop.dll.13.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: SELECT Timestamp FROM StatisticsSendTime ORDER BY Timestamp DESC LIMIT 1;
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS [AlertsSent] (Id INTEGER NOT NULL PRIMARY KEY, Timestamp BIGINT NOT NULL, Alerts TEXT NOT NULL);sSELECT MAX([Timestamp]) AS [TimeStamp] FROM [AlertsSent];
Source: AgentPackageMonitoring.exe, AgentPackageMonitoring.exe, 00000025.00000002.2984192827.00007FFDF12EA000.00000002.00000001.01000000.0000001C.sdmp, SQLite.Interop.dll.13.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: SELECT [Id], [Alerts], [Timestamp] FROM [AlertsSent] ORDER BY [Timestamp] DESC LIMIT 1;
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS Statistics (Id INTEGER PRIMARY KEY,Name TEXT NOT NULL,Timestamp BIGINT NOT NULL,Value TEXT NOT NULL);/DELETE FROM Statistics;eSELECT Id, Name, Timestamp, Value FROM Statistics;
Source: AgentPackageMonitoring.exe, 00000025.00000002.2964825175.000001A420BF5000.00000004.00000020.00020000.00000000.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS [AlertsSent] (Id INTEGER NOT NULL PRIMARY KEY, Timestamp BIGINT NOT NULL, Alerts TEXT NOT NULL);
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS ThresholdsProfiles (Id INTEGER NOT NULL PRIMARY KEY,IsActive BOOLEAN NOT NULL,Timestamp BIGINT NOT NULL,Name TEXT NOT NULL,Thresholds TEXT NOT NULL); CREATE INDEX IF NOT EXISTS idx_ThresholdsProfiles_Timestamp ON ThresholdsProfiles (Timestamp);
Source: AgentPackageMonitoring.exe, AgentPackageMonitoring.exe, 00000025.00000002.2984192827.00007FFDF12EA000.00000002.00000001.01000000.0000001C.sdmp, SQLite.Interop.dll.13.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS Statistics (Id INTEGER PRIMARY KEY,Name TEXT NOT NULL,Timestamp BIGINT NOT NULL,Value TEXT NOT NULL);@X9
Source: AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS ThresholdDuration (Id INTEGER PRIMARY KEY,Identifier TEXT NOT NULL,Severity TEXT NOT NULL,Timestamp BIGINT NOT NULL);
Source: AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS AlertedEvents_V2 (Id INTEGER PRIMARY KEY, Timestamp BIGINT NOT NULL, LogName TEXT NOT NULL, Severity INTEGER NOT NULL, RecordId BIGINT NOT NULL, EventId BIGINT NOT NULL, Source TEXT NOT NULL, Message TEXT NULL);
Source: AgentPackageMonitoring.exe, AgentPackageMonitoring.exe, 00000025.00000002.2984192827.00007FFDF12EA000.00000002.00000001.01000000.0000001C.sdmp, SQLite.Interop.dll.13.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: select Name from Win32_PerfFormattedData_Tcpip_NetworkInterface!DataStatsEnabled9InboundBandwidthStatsEnabled;OutboundBandwidthStatsEnabled
Source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: SELECT Id, IsActive, Timestamp, Name, Thresholds FROM ThresholdsProfiles ORDER BY Timestamp DESC LIMIT 1;

Source: RQ--029.msi

Static file information: TRID: Microsoft Windows Installer (60509/1) 57.88%

Source: RQ--029.msi	Virustotal: Detection: 19%
Source: RQ--029.msi	ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\RQ--029.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3B85228B7D1C8929A727F0F59CB02AA3
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI25B4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5449250 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI2CD9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5451000 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI438F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5456796 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CACFC9F983F5284DFDC6FC6746D31D7F E Global\MSI0000
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\net.exe "NET" STOP AteraAgent
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 STOP AteraAgent
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "TaskKill.exe" /f /im AteraAgent.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="contato@opticaperformance.com.br" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000OJqMsIAL" /AgentId="14216fa6-dc15-4519-acf9-f0e1b34954b6"
Source: unknown	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI619B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5464500 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dfd08f75-8b51-48fd-ab32-5327cfebcacf" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "0b83ff3f-4e98-4112-9bc1-991064e5f975" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dd995738-a43a-417d-bb93-8167d39082a0" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "6141f59d-aac4-4ed0-a2a6-5cc28d11fb39" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOm51bGwsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k smphost
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "be3e4666-7f93-4f4c-b51b-88298548f7af" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3B85228B7D1C8929A727F0F59CB02AA3	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CACFC9F983F5284DFDC6FC6746D31D7F E Global\MSI0000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="contato@opticaperformance.com.br" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000OJqMsIAL" /AgentId="14216fa6-dc15-4519-acf9-f0e1b34954b6"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI25B4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5449250 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI2CD9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5451000 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI438F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5456796 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI619B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5464500 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\net.exe "NET" STOP AteraAgent	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "TaskKill.exe" /f /im AteraAgent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 STOP AteraAgent	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dfd08f75-8b51-48fd-ab32-5327cfebcacf" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "0b83ff3f-4e98-4112-9bc1-991064e5f975" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dd995738-a43a-417d-bb93-8167d39082a0" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "6141f59d-aac4-4ed0-a2a6-5cc28d11fb39" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOm51bGwsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "be3e4666-7f93-4f4c-b51b-88298548f7af" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: rasman.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: rtutils.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: amsi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: cryptnet.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: webio.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: amsi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: rasman.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: rtutils.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: amsi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: wscapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: rasman.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: rtutils.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: napinsp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: pnrpnsp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: wshbth.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: winrnr.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: rasman.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: rtutils.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: amsi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: rasman.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: rtutils.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: smphost.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mispace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sxshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wmiclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: virtdisk.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clusapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fmifs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ifsutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: healthapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: healthapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsp_fs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsp_sr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsp_health.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: healthapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: healthapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Section loaded: msasn1.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

File written: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.ini

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: RQ--029.msi

Static file information: File size 2994176 > 1048576

Source:	Binary string: D:\a\1\s\AgentPackageAgentInformation\AgentPackageAgentInformation\obj\Release\AgentPackageAgentInformation.pdb source: AgentPackageAgentInformation.exe, 00000015.00000000.2560902012.00000262141B2000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\projects\polly\src\Polly\obj\Release\netstandard1.1\Polly.pdb source: AgentPackageMonitoring.exe, 00000025.00000002.2955308908.000001A41FB02000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\CodeBases\isdev\Redist\Language Independent\i386\ISSetup.pdb source: SplashtopStreamer.exe.34.dr
Source:	Binary string: d:\slave\workspace\GIT_WIN_SRS_Formal\Source\irisserver\Release\SRUnPackFile.pdb source: SplashtopStreamer.exe.34.dr
Source:	Binary string: D:\a\1\s\AlphaControlAgentInstallation\obj\Release\AlphaControlAgentInstallation.pdb source: rundll32.exe, 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\polly\src\Polly\obj\Release\netstandard1.1\Polly.pdbSHA256 source: AgentPackageMonitoring.exe, 00000025.00000002.2955308908.000001A41FB02000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\41\s\AteraNugetPackages\Atera.AgentPackages.ModelsV3\Atera.AgentPackages.ModelsV3\obj\Release\net45\Atera.AgentPackages.ModelsV3.pdbSHA256t source: Atera.AgentPackages.ModelsV3.dll.13.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: AgentPackageAgentInformation.exe, 00000015.00000002.2610139637.000002622D2A2000.00000002.00000001.01000000.00000019.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2924444903.000002BDDC982000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\s\AlphaControlAgent\obj\Release\AteraAgent.pdb<$ source: AteraAgent.exe, 0000000C.00000000.1766473024.000001DF810F2000.00000002.00000001.01000000.0000000F.sdmp, AteraAgent.exe, 0000001B.00000002.2954879800.000001B2DFC48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: AteraAgent.exe, 0000001B.00000002.2954879800.000001B2DFC48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000015.00000002.2610139637.000002622D2A2000.00000002.00000001.01000000.00000019.sdmp, AteraAgent.exe, 0000001B.00000002.2952786726.000001B2DFA30000.00000002.00000001.01000000.00000020.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2924444903.000002BDDC982000.00000002.00000001.01000000.0000001F.sdmp, Newtonsoft.Json.dll1.13.dr, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr
Source:	Binary string: D:\a\1\s\Atera.AgentPackage.Common\obj\Release\Atera.AgentPackage.Common.pdb source: AgentPackageAgentInformation.exe, 00000015.00000002.2609275400.0000026214AE2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\41\s\AteraNugetPackages\Atera.AgentPackages.ModelsV3\Atera.AgentPackages.ModelsV3\obj\Release\net45\Atera.AgentPackages.ModelsV3.pdb source: Atera.AgentPackages.ModelsV3.dll.13.dr
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netstandard1.0\System.ValueTuple.pdb source: System.ValueTuple.dll.13.dr
Source:	Binary string: t.pdb source: AteraAgent.exe, 0000001B.00000002.2947188858.000001B2DF7E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet-private\obj\2012\System.Data.SQLite.2012\Release\System.Data.SQLite.pdbp+ source: AgentPackageMonitoring.exe, 00000025.00000002.2963387299.000001A41FED2000.00000002.00000001.01000000.00000027.sdmp, System.Data.SQLite.dll.13.dr
Source:	Binary string: C:\projects\nlog\src\NLog\obj\Release\net45\NLog.pdb source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: D:\a\1\s\AgentPackageMonitoring\AgentPackageMonitoring\obj\Release\AgentPackageMonitoring.pdb source: AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\wixca.pdb source: RQ--029.msi, MSI472D.tmp.1.dr
Source:	Binary string: C:\projects\structuremap\src\StructureMap\obj\Release\net45\StructureMap.pdb source: AgentPackageMonitoring.exe, 00000025.00000002.2953115262.000001A41FA62000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbP source: rundll32.exe, 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr
Source:	Binary string: C:\projects\structuremap\src\StructureMap\obj\Release\net45\StructureMap.pdbSHA256`{f source: AgentPackageMonitoring.exe, 00000025.00000002.2953115262.000001A41FA62000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\a\1\s\Atera.AgentPackage.Common\obj\Release\Atera.AgentPackage.Common.pdbPf source: AgentPackageAgentInformation.exe, 00000015.00000002.2609275400.0000026214AE2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: System.pdb source: AteraAgent.exe, 0000001B.00000002.2954879800.000001B2DFC48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: rundll32.exe, 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr
Source:	Binary string: D:\a\1\s\AlphaControlAgent\obj\Release\AteraAgent.pdb source: AteraAgent.exe, 0000000C.00000000.1766473024.000001DF810F2000.00000002.00000001.01000000.0000000F.sdmp, AteraAgent.exe, 0000001B.00000002.2954879800.000001B2DFC48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet-private\bin\2012\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: AgentPackageMonitoring.exe, 00000025.00000002.2984192827.00007FFDF12EA000.00000002.00000001.01000000.0000001C.sdmp, SQLite.Interop.dll.13.dr
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netstandard1.0\System.ValueTuple.pdbSHA256 source: System.ValueTuple.dll.13.dr
Source:	Binary string: D:\a\c-sharp\c-sharp\src\Api\PubnubApi\obj\Release\net45\Pubnub.pdbSHA256 source: AteraAgent.exe, 0000000C.00000002.1823489773.000001DF9B5C2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\c-sharp\c-sharp\src\Api\PubnubApi\obj\Release\net45\Pubnub.pdb source: AteraAgent.exe, 0000000C.00000002.1823489773.000001DF9B5C2000.00000002.00000001.01000000.00000011.sdmp, AteraAgent.exe, 0000000D.00000002.2970173077.0000015E54BC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet-private\obj\2012\System.Data.SQLite.2012\Release\System.Data.SQLite.pdb source: AgentPackageMonitoring.exe, 00000025.00000002.2963387299.000001A41FED2000.00000002.00000001.01000000.00000027.sdmp, System.Data.SQLite.dll.13.dr
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard1.1\System.Memory.pdb source: System.Memory.dll.13.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\SfxCA.pdb source: RQ--029.msi, MSI2CD9.tmp.1.dr
Source:	Binary string: /_/src/ICSharpCode.SharpZipLib/obj/Release/net45/ICSharpCode.SharpZipLib.pdbSHA256mW source: AteraAgent.exe, 0000000D.00000002.2969713270.0000015E54AB2000.00000002.00000001.01000000.00000028.sdmp, ICSharpCode.SharpZipLib.dll.1.dr
Source:	Binary string: /_/src/ICSharpCode.SharpZipLib/obj/Release/net45/ICSharpCode.SharpZipLib.pdb source: AteraAgent.exe, 0000000D.00000002.2969713270.0000015E54AB2000.00000002.00000001.01000000.00000028.sdmp, ICSharpCode.SharpZipLib.dll.1.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA2567 source: rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2952786726.000001B2DFA30000.00000002.00000001.01000000.00000020.sdmp, Newtonsoft.Json.dll1.13.dr, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard1.1\System.Memory.pdbSHA256 source: System.Memory.dll.13.dr
Source:	Binary string: C:\code\dapper-dot-net\Dapper\bin\Release\net45\Dapper.pdb source: AgentPackageMonitoring.exe, 00000025.00000002.2959308545.000001A41FCD2000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: C:\projects\nlog\src\NLog\obj\Release\net45\NLog.pdbSHA256d source: AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp

Source: BouncyCastle.Crypto.dll.1.dr

Static PE information: 0xE49A52B3 [Sun Jul 15 06:22:43 2091 UTC]

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

Code function: 37_2_00007FFDF11A1910 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

37_2_00007FFDF11A1910

Source: MSI25B4.tmp.1.dr	Static PE information: real checksum: 0x32353 should be: 0x88610
Source: MSI2CD9.tmp.1.dr	Static PE information: real checksum: 0x32353 should be: 0x88610
Source: MSI438F.tmp.1.dr	Static PE information: real checksum: 0x32353 should be: 0x88610

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_067F57B8 push es; ret	4_3_067F5840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_067F4E90 push es; ret	4_3_067F4EA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_067F58B0 push es; ret	4_3_067F58C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_068E4ECF push dword ptr [esp+ecx*2-75h]; ret	4_3_068E4ED3
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 13_2_00007FFD9B5892A5 push ebx; retf	13_2_00007FFD9B5892AA
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 13_2_00007FFD9B580F38 push eax; ret	13_2_00007FFD9B580F94
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 13_2_00007FFD9B59125A push edx; iretd	13_2_00007FFD9B59125B
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B387969 push ebx; retf	21_2_00007FFD9B38796A
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 21_2_00007FFD9B3700BD pushad ; iretd	21_2_00007FFD9B3700C1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3D62B0 pushad ; retn 5F48h	23_2_00007FFD9B3D62CD
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3CCAD0 push eax; retn 5F4Fh	23_2_00007FFD9B3CE0FD
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3B7967 push ebx; retf	23_2_00007FFD9B3B796A
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3A2D95 push eax; ret	23_2_00007FFD9B3A2E1D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 23_2_00007FFD9B3A00BD pushad ; iretd	23_2_00007FFD9B3A00C1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Code function: 25_2_00007FFD9B3A00BD pushad ; iretd	25_2_00007FFD9B3A00C1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B37A642 push eax; retf	27_2_00007FFD9B37A659
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B37A648 push eax; retf	27_2_00007FFD9B37A659
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B3825F2 push eax; iretd	27_2_00007FFD9B382671
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B580F64 push eax; ret	27_2_00007FFD9B580F94
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Code function: 27_2_00007FFD9B58000A push cs; retf	27_2_00007FFD9B58002A
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B387C18 push eax; retf 5F4Dh	34_2_00007FFD9B387D6D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B38D699 push es; retf	34_2_00007FFD9B38D847
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B377C2E pushad ; retf	34_2_00007FFD9B377C5D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B38C2BE pushad ; iretd	34_2_00007FFD9B38C2BF
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B3700BD pushad ; iretd	34_2_00007FFD9B3700C1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B377913 push ebx; retf	34_2_00007FFD9B37796A
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B375580 push edx; iretd	34_2_00007FFD9B3755DB
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Code function: 34_2_00007FFD9B377C5E push eax; retf	34_2_00007FFD9B377C6D
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11CFAB0 push rbp; ret	37_2_00007FFDF11CFAB1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFDF11B8961 push r8; ret	37_2_00007FFDF11B8963
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Code function: 37_2_00007FFD9B368426 push eax; ret	37_2_00007FFD9B36846D

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BA74182F76F15A9CF514DEF352303C95
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\329B6147266C1E26CD774EA22B79EC2E
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageAgentInformation.exe.log

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Diagnostics.DiagnosticSource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.CommonLib.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\System.Management.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.Utils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI619B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI25B4.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\StructureMap.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\AlphaControlAgentInstallation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.ModelsV3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\AlphaControlAgentInstallation.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4603.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\NLog.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Polly.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\AlphaControlAgentInstallation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2CD9.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\AlphaControlAgentInstallation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\x86\SQLite.Interop.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4594.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI438F.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\System.Management.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\System.Management.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Microsoft.ApplicationInsights.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Dapper.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\System.Management.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI472D.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackage.Common.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Memory.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	File created: C:\Windows\Temp\SplashtopStreamer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.ValueTuple.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Atera.AgentPackage.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\OpenHardwareMonitorLib.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4594.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI438F.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\System.Management.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\System.Management.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\System.Management.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI619B.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\System.Management.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI472D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI25B4.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	File created: C:\Windows\Temp\SplashtopStreamer.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\AlphaControlAgentInstallation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\AlphaControlAgentInstallation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4603.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI619B.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI438F.tmp-\AlphaControlAgentInstallation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2CD9.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI25B4.tmp-\AlphaControlAgentInstallation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\MSI2CD9.tmp-\Newtonsoft.Json.dll	Jump to dropped file

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Windows\system32\InstallUtil.InstallLog			Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	File created: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog			Jump to behavior

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\net.exe "NET" STOP AteraAgent

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Process created: C:\Windows\System32\sc.exe "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

Code function: 37_2_00007FFDF119A524 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

37_2_00007FFDF119A524

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Registry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Registry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Registry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Registry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Registry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Registry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Registry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Key value created or modified: HKEY_USERS.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDrive
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_DiskDrive.DeviceID="\\\\.\\PHYSICALDRIVE0"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Antecedent="Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\""
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDrive
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_DiskDrive.DeviceID="\\\\.\\PHYSICALDRIVE0"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Antecedent="Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\""

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapter
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapter
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select PhysicalAdapter,Name,PNPDeviceID from Win32_NetworkAdapter
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapter

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : select Name,DisplayName,Description,State from Win32_Service

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #0"} where resultclass = Win32_LogicalDisk
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Antecedent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #0\""
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_LogicalDisk
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Antecedent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #2"} where resultclass = Win32_LogicalDisk
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Antecedent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #2\""
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Size,FreeSpace,Name FROM Win32_LogicalDisk where DriveType=3
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #0"} where resultclass = Win32_LogicalDisk
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Antecedent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #0\""
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_LogicalDisk
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Antecedent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #2"} where resultclass = Win32_LogicalDisk
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Antecedent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #2\""

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select Name from Win32_SoundDevice

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Memory allocated: 1DF81440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Memory allocated: 1DF9AF00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Memory allocated: 15E3B8E0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Memory allocated: 15E53BF0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Memory allocated: 26214990000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Memory allocated: 2622CB30000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Memory allocated: 1DDE4980000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Memory allocated: 1DDFCB70000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Memory allocated: 221ACA50000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Memory allocated: 221C4BB0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Memory allocated: 1B2C68F0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Memory allocated: 1B2DEF40000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Memory allocated: 2BDDC210000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Memory allocated: 2BDF4A50000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Memory allocated: 1A406DF0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Memory allocated: 1A41F3A0000 memory reserve \| memory write watch

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599891
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599781
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599671
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599563
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599438
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599328
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599177
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598729
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598608
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598499
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598391
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598281
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598171
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598063
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597938
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597813
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597688
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597578
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597469
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597344
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597234
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597125
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597016
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596905
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596796
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596687
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596578
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596469
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596332
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596188
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596049
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595867
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595750
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595641
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595516
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595406
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595297
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595187
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595078
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 594969
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599875
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599765
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599656
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599545
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599393
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599266
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599141
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599031
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598921
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598812
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598703
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598594
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598484
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598375
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598266
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598141
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598016
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597906
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597797
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597687
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597578
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597468
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597359
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597249
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597140
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597031
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596922
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596812
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596703
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596594
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596484
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596375
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596266
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596156
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596047
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595937
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595828
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595711
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595609
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595500
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595391
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595266
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595141
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595031
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 594880
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 594432
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 594311
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 594203
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 594094
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 593969
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Thread delayed: delay time: 922337203685477

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Window / User API: threadDelayed 3100
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Window / User API: threadDelayed 6651
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Window / User API: threadDelayed 8500
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Window / User API: threadDelayed 1342
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Window / User API: threadDelayed 897
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Window / User API: threadDelayed 8637
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Window / User API: threadDelayed 8874
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Window / User API: threadDelayed 961
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Window / User API: threadDelayed 867

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Diagnostics.DiagnosticSource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.CommonLib.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI25B4.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI619B.tmp-\System.Management.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI438F.tmp-\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.Utils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI619B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI25B4.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\StructureMap.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI619B.tmp-\AlphaControlAgentInstallation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.ModelsV3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2CD9.tmp-\AlphaControlAgentInstallation.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4603.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\NLog.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Polly.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI438F.tmp-\AlphaControlAgentInstallation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2CD9.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI25B4.tmp-\AlphaControlAgentInstallation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2CD9.tmp-\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI25B4.tmp-\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\x86\SQLite.Interop.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4594.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI438F.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI25B4.tmp-\System.Management.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI438F.tmp-\System.Management.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Microsoft.ApplicationInsights.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI438F.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Dapper.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI619B.tmp-\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2CD9.tmp-\System.Management.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackage.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI472D.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Memory.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Dropped PE file which has not been started: C:\Windows\Temp\SplashtopStreamer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.ValueTuple.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI619B.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Atera.AgentPackage.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2CD9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\OpenHardwareMonitorLib.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7592	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 7972	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 7936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 8152	Thread sleep count: 3100 > 30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 8152	Thread sleep count: 6651 > 30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 416	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 416	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 5480	Thread sleep time: -220000s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 7312	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 7304	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3328	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7968	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7920	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 2716	Thread sleep count: 8500 > 30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 5424	Thread sleep count: 1342 > 30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -25825441703193356s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -599891s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -599781s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -599671s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -599563s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -599438s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -599328s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -599177s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -598729s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -598608s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -598499s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -598391s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -598281s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -598171s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -598063s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -597938s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -597813s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -597688s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -597578s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -597469s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -597344s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -597234s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -597125s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -597016s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -596905s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -596796s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -596687s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -596578s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -596469s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -596332s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -596188s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -596049s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -595867s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -595750s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -595641s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -595516s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -595406s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -595297s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -595187s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -595078s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7676	Thread sleep time: -594969s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe TID: 7496	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 5940	Thread sleep count: 897 > 30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 5940	Thread sleep count: 8637 > 30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 6252	Thread sleep count: 33 > 30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 6252	Thread sleep time: -30437127721620741s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 6252	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 6440	Thread sleep time: -290000s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 6456	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 6408	Thread sleep time: -180000s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe TID: 6456	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep count: 31 > 30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -28592453314249787s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 7020	Thread sleep count: 8874 > 30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -599875s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 7020	Thread sleep count: 961 > 30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -599765s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -599656s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -599545s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -599393s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -599266s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -599141s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -599031s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -598921s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -598812s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -598703s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -598594s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -598484s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -598375s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -598266s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -598141s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -598016s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -597906s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -597797s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -597687s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -597578s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -597468s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -597359s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -597249s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -597140s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -597031s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -596922s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -596812s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -596703s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -596594s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -596484s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -596375s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -596266s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -596156s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -596047s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -595937s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -595828s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -595711s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -595609s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -595500s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -595391s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -595266s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -595141s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -595031s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -594880s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -594432s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -594311s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -594203s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -594094s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe TID: 6972	Thread sleep time: -593969s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe TID: 5236	Thread sleep count: 867 > 30
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe TID: 180	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe TID: 180	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe TID: 5236	Thread sleep count: 203 > 30

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select Manufacturer,Model,Product from Win32_BaseBoard
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select Manufacturer,Model,Product from Win32_BaseBoard
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : select Manufacturer,SoftwareElementID,ReleaseDate from Win32_BIOS
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select Manufacturer,Model,Product from Win32_BaseBoard

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select PartOfDomain,Workgroup,Domain FROM Win32_ComputerSystem
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Name from Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Name from Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Name from Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select MaxClockSpeed from Win32_Processor
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 30000
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 90000
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599891
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599781
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599671
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599563
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599438
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599328
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 599177
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598729
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598608
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598499
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598391
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598281
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598171
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 598063
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597938
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597813
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597688
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597578
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597469
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597344
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597234
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597125
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 597016
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596905
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596796
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596687
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596578
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596469
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596332
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596188
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 596049
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595867
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595750
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595641
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595516
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595406
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595297
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595187
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 595078
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 594969
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 30000
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 90000
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599875
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599765
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599656
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599545
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599393
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599266
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599141
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 599031
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598921
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598812
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598703
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598594
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598484
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598375
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598266
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598141
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 598016
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597906
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597797
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597687
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597578
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597468
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597359
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597249
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597140
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 597031
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596922
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596812
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596703
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596594
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596484
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596375
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596266
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596156
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 596047
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595937
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595828
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595711
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595609
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595500
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595391
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595266
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595141
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 595031
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 594880
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 594432
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 594311
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 594203
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 594094
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Thread delayed: delay time: 593969
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Thread delayed: delay time: 30000

Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service0
Source: svchost.exe, 00000024.00000002.2919330298.0000015DE2723000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: svchost.exe, 00000024.00000002.2918758293.0000015DE24D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Files\O @SetPropValue.Manufacturer("VMware");
Source: AteraAgent.exe, 0000001B.00000002.2947188858.000001B2DF761000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: beat ServicevmicheartbeatHuxq
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2835737807.000001DDFD4BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSFT_PhysicalDisk{1}\\user-PC\root/Microsoft/Windows/Storage/Providers_v2\SPACES_PhysicalDisk.ObjectId="{a33c734b-61ca-11ee-8c18-806e6f6e6963}:PD:{fadc7a83-6534-864a-66c8-a75a642cb79f}"6000C2942FCE4D06663969F532E45D1AVMware Virtual diskVMwareVirtual disk6000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B6EC000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B78E000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2964905053.0000015E54749000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000024.00000002.2919330298.0000015DE2723000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2827219433.000001DDE438A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Provides an interface for the Hyper-V hypervisor to provide per-partition performance counters to the host operating system.
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2833724925.000001DDFD399000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServicevmicshutdownvmicshutdownStopped]c
Source: AgentPackageMonitoring.exe, 00000025.00000002.2956305413.000001A41FC23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: AgentPackageAgentInformation.exe, 00000015.00000000.2560902012.00000262141B2000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: VIRUSfighterAVMware Carbon Black Cloud Sensor7VMware Carbon Black Defense/VMware Carbon Black EDR9VMware Carbon Black Response
Source: svchost.exe, 00000024.00000003.2743534899.0000015DE261A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 006000C2942FCE4D06663969F532E45D1A
Source: svchost.exe, 00000024.00000002.2918359277.0000015DE24B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 006000C2942FCE4D06663969F532E45D1Aind
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: !Hyper-V PowerShell Direct Service0
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2834949737.000001DDFD41A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmicshutdownw
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2833724925.000001DDFD399000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServicevmicheartbeatvmicheartbeatStopped
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: svchost.exe, 00000024.00000002.2918015615.0000015DE244D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JSetPropValue.Manufacturer("VMware");
Source: AgentPackageMonitoring.exe, 00000025.00000002.2922460675.000001A406E32000.00000002.00000001.01000000.0000001D.sdmp	Binary or memory string: vmware
Source: AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IsVirtualMachine
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2834949737.000001DDFD41A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServiceSynchronizes the system time of this virtual machine with the system time of the physical computer.Hyper-V Time Synchronization ServicevmictimesyncStoppedc
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2827219433.000001DDE438A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServiceProvides an interface for the Hyper-V hypervisor to provide per-partition performance counters to the host operating system.HV Host ServiceHvHostStoppedG
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2827219433.000001DDE438A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServiceProvides a mechanism to exchange data between the virtual machine and the operating system running on the physical computer.Hyper-V Data Exchange ServicevmickvpexchangeStopped[
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface0
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Volume Shadow Copy Requestor0
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2827219433.000001DDE438A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2834949737.000001DDFD41A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Provides an interface for the Hyper-V host to interact with specific services running inside the virtual machine.
Source: svchost.exe, 00000024.00000002.2918359277.0000015DE24B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk6000C2942FCE4D06663969F532E45D1A0VMwareVirtual disk6
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2834949737.000001DDFD41A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: svchost.exe, 00000024.00000002.2918359277.0000015DE24A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .@SetPropValue.FriendlyName("VMware Virtual disk");
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: svchost.exe, 00000024.00000002.2918015615.0000015DE244D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dSetPropValue.FriendlyName("VMware Virtual disk");
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -Hyper-V Remote Desktop Virtualization Service0
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2833724925.000001DDFD399000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServicevmicvssvmicvssStopped
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2834949737.000001DDFD41A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service0
Source: AteraAgent.exe, 0000000D.00000002.2958992188.0000015E542F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW FrT^
Source: svchost.exe, 00000024.00000002.2918015615.0000015DE244D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.VMware20,1NoneVMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: AteraAgent.exe, 0000000C.00000002.1823822816.000001DF9B733000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000004.00000002.1747045541.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1881703398.00000000009F7000.00000004.00000020.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000015.00000002.2610343948.000002622D350000.00000004.00000020.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2835541034.000001DDFD4A8000.00000004.00000020.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2947188858.000001B2DF761000.00000004.00000020.00020000.00000000.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2940815641.000002BDF5147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2834949737.000001DDFD41A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServiceProvides a mechanism to manage virtual machine with PowerShell via VM session without a virtual network.Hyper-V PowerShell Direct ServicevmicvmsessionStopped
Source: AgentPackageMonitoring.exe, 00000025.00000002.2922460675.000001A406E32000.00000002.00000001.01000000.0000001D.sdmp, AgentPackageMonitoring.exe, 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: get_IsVirtualMachine
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2834949737.000001DDFD41A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_ServiceProvides an interface for the Hyper-V host to interact with specific services running inside the virtual machine.Hyper-V Guest Service InterfacevmicguestinterfaceStopped
Source: AgentPackageAgentInformation.exe, 00000017.00000002.2834949737.000001DDFD41A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Time Synchronization Service0
Source: AteraAgent.exe, 0000000D.00000002.2964905053.0000015E54720000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWrogram Files (x86)/ATERA Networks/AteraAgent/ICSharpCode.SharpZipLib.EXEb.EXE
Source: AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C703A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service0
Source: svchost.exe, 00000024.00000002.2919330298.0000015DE2723000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SPACES_PhysicalDisk{a33c734b-61ca-11ee-8c18-806e6f6e6963}:PD:{fadc7a83-6534-864a-66c8-a75a642cb79f}6000C2942FCE4D06663969F532E45D1AVMware Virtual diskVMwareVirtual disk6000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0
Source: svchost.exe, 00000024.00000002.2918758293.0000015DE24D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@SetPropValue.Manufacturer("VMware");

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

37_2_00007FFDF11A1910

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

Code function: 37_2_00007FFDF11DB9F0 GetModuleHandleW,OutputDebugStringA,GetProcAddress,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,GetModuleHandleW,OutputDebugStringA,GetLastError,GetProcAddress,OutputDebugStringA,OutputDebugStringA,CorBindToRuntimeEx,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,_snprintf,OutputDebugStringA,

37_2_00007FFDF11DB9F0

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

37_2_00007FFDF11A1910

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

Code function: 37_2_00007FFDF1197A84 GetProcessHeap,

37_2_00007FFDF1197A84

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Process token adjusted: Debug

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

Code function: 37_2_00007FFDF119ACD4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

37_2_00007FFDF119ACD4

Source: C:\Windows\SysWOW64\rundll32.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="contato@opticaperformance.com.br" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000OJqMsIAL" /AgentId="14216fa6-dc15-4519-acf9-f0e1b34954b6"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\net.exe "NET" STOP AteraAgent	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "TaskKill.exe" /f /im AteraAgent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 STOP AteraAgent	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dfd08f75-8b51-48fd-ab32-5327cfebcacf" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "0b83ff3f-4e98-4112-9bc1-991064e5f975" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dd995738-a43a-417d-bb93-8167d39082a0" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "6141f59d-aac4-4ed0-a2a6-5cc28d11fb39" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOm51bGwsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "be3e4666-7f93-4f4c-b51b-88298548f7af" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000OJqMsIAL
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\taskkill.exe "TaskKill.exe" /f /im AteraAgent.exe

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe "c:\program files (x86)\atera networks\ateraagent\ateraagent.exe" /i /integratorlogin="contato@opticaperformance.com.br" /companyid="1" /integratorloginui="" /companyidui="" /folderid="" /accountid="001q300000ojqmsial" /agentid="14216fa6-dc15-4519-acf9-f0e1b34954b6"
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "c:\program files (x86)\atera networks\ateraagent\packages\agentpackageagentinformation\agentpackageagentinformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dfd08f75-8b51-48fd-ab32-5327cfebcacf" agent-api.atera.com/production 443 or8ixli90mf "minimalidentification" 001q300000ojqmsial
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "c:\program files (x86)\atera networks\ateraagent\packages\agentpackageagentinformation\agentpackageagentinformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "0b83ff3f-4e98-4112-9bc1-991064e5f975" agent-api.atera.com/production 443 or8ixli90mf "generalinfo fromgui" 001q300000ojqmsial
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "c:\program files (x86)\atera networks\ateraagent\packages\agentpackageagentinformation\agentpackageagentinformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dd995738-a43a-417d-bb93-8167d39082a0" agent-api.atera.com/production 443 or8ixli90mf "identified" 001q300000ojqmsial
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe "c:\program files (x86)\atera networks\ateraagent\packages\agentpackagestremote\agentpackagestremote.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "6141f59d-aac4-4ed0-a2a6-5cc28d11fb39" agent-api.atera.com/production 443 or8ixli90mf "install eyjsbw1db2rlijoiafpdrezqaes3nw1kiiwiumvxdwvzdfblcm1pc3npb25pchrpb24iom51bgwsiljlcxvpcmvqyxnzd29yze9wdglvbii6bnvsbcwiugfzc3dvcmqiom51bgx9" 001q300000ojqmsial
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe "c:\program files (x86)\atera networks\ateraagent\packages\agentpackagemonitoring\agentpackagemonitoring.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "be3e4666-7f93-4f4c-b51b-88298548f7af" agent-api.atera.com/production 443 or8ixli90mf "syncprofile" 001q300000ojqmsial
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe "c:\program files (x86)\atera networks\ateraagent\ateraagent.exe" /i /integratorlogin="contato@opticaperformance.com.br" /companyid="1" /integratorloginui="" /companyidui="" /folderid="" /accountid="001q300000ojqmsial" /agentid="14216fa6-dc15-4519-acf9-f0e1b34954b6"	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "c:\program files (x86)\atera networks\ateraagent\packages\agentpackageagentinformation\agentpackageagentinformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dfd08f75-8b51-48fd-ab32-5327cfebcacf" agent-api.atera.com/production 443 or8ixli90mf "minimalidentification" 001q300000ojqmsial
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "c:\program files (x86)\atera networks\ateraagent\packages\agentpackageagentinformation\agentpackageagentinformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "0b83ff3f-4e98-4112-9bc1-991064e5f975" agent-api.atera.com/production 443 or8ixli90mf "generalinfo fromgui" 001q300000ojqmsial
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe "c:\program files (x86)\atera networks\ateraagent\packages\agentpackageagentinformation\agentpackageagentinformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dd995738-a43a-417d-bb93-8167d39082a0" agent-api.atera.com/production 443 or8ixli90mf "identified" 001q300000ojqmsial
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe "c:\program files (x86)\atera networks\ateraagent\packages\agentpackagestremote\agentpackagestremote.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "6141f59d-aac4-4ed0-a2a6-5cc28d11fb39" agent-api.atera.com/production 443 or8ixli90mf "install eyjsbw1db2rlijoiafpdrezqaes3nw1kiiwiumvxdwvzdfblcm1pc3npb25pchrpb24iom51bgwsiljlcxvpcmvqyxnzd29yze9wdglvbii6bnvsbcwiugfzc3dvcmqiom51bgx9" 001q300000ojqmsial
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Process created: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe "c:\program files (x86)\atera networks\ateraagent\packages\agentpackagemonitoring\agentpackagemonitoring.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "be3e4666-7f93-4f4c-b51b-88298548f7af" agent-api.atera.com/production 443 or8ixli90mf "syncprofile" 001q300000ojqmsial

Source: SplashtopStreamer.exe.34.dr	Binary or memory string: ?OPTYPE_PROGMAN_FIELDSWWW
Source: SplashtopStreamer.exe.34.dr	Binary or memory string: ISLOG_VERSION_INFO..\..\..\Shared\LogServices2\LogDB.cppOPTYPE_PROGMANISLOGDB_USER_PROPERTIES4

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

Code function: 37_2_00007FFDF119739C cpuid

37_2_00007FFDF119739C

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSI25B4.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSI25B4.tmp-\AlphaControlAgentInstallation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSI2CD9.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSI2CD9.tmp-\AlphaControlAgentInstallation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSI2CD9.tmp-\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSI438F.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSI438F.tmp-\AlphaControlAgentInstallation.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSI619B.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSI619B.tmp-\AlphaControlAgentInstallation.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Installer\MSI619B.tmp-\Newtonsoft.Json.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Atera.AgentPackage.Common.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\StructureMap.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.CommonLib.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\OpenHardwareMonitorLib.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Polly.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Tasks\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Threading.Tasks.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\NLog.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Collections\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Collections.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Linq.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Data.SQLite.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Dapper.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

Code function: 37_2_00007FFDF119CC04 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

37_2_00007FFDF119CC04

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

Code function: 37_2_00007FFDF11985D4 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,_malloc_crt,_invoke_watson,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,

37_2_00007FFDF11985D4

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select displayName,productState from AntiVirusProduct
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select displayName,productState from AntiSpywareProduct
Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select displayName,productState from FirewallProduct

Remote Access Functionality

Yara detected AteraAgent

Source: Yara match	File source: 34.0.AgentPackageSTRemote.exe.2bddbed0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.AgentPackageAgentInformation.exe.26214ae0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.AgentPackageMonitoring.exe.1a406e30000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.AteraAgent.exe.1df810f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.AgentPackageMonitoring.exe.1a406980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.AgentPackageAgentInformation.exe.262141b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.2608580404.000002621447C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2828323869.000001DDE4DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2703342225.0000021125FFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1749347665.00000000044E4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2910170206.0000001534165000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2933946577.0000015E3BE3D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1883270062.0000000004954000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2933946577.0000015E3BC5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2921232065.000001B2C69A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821854743.000001DF82FB2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821854743.000001DF8307C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2926789320.0000015E3B22C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2925832359.0000015E3B1C0000.00000004.00000020.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.2669697402.000002BDDBED2000.00000002.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2911502671.00000039F5375000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1823822816.000001DF9B78E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2956305413.000001A41FB7F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2608580404.0000026214380000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2920984998.000001A406B70000.00000004.00000020.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2827219433.000001DDE438A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1766473024.000001DF810F2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1826138736.00007FFD9B414000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2923031816.000002BDDC240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926775706.000001B2C6FD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821854743.000001DF82FBA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2922460675.000001A406E32000.00000002.00000001.01000000.0000001D.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2956305413.000001A41FBB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2964905053.0000015E54720000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2933946577.0000015E3BDC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2958992188.0000015E54373000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2954879800.000001B2DFC7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2966506202.0000015E547DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2828323869.000001DDE4DDF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821854743.000001DF83066000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821854743.000001DF82F89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2940815641.000002BDF5147000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2918270056.000002BDDC0A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2921232065.000001B2C6920000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821854743.000001DF82FB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2837681843.000001DDFD673000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2918270056.000002BDDC06C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2954879800.000001B2DFC20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2637732373.00000221AC452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2703342225.0000021125FF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2638815527.0000021126220000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2835065748.000001DDFD432000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2918270056.000002BDDC060000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1883270062.00000000048B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2964825175.000001A420C08000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2609356829.0000026214B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821854743.000001DF83032000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2609078888.00000262145B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2921232065.000001B2C69DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1820419607.000001DF8119C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2610343948.000002622D40B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926775706.000001B2C6F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2933946577.0000015E3BE41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2836087609.000001DDFD58C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2927182354.000002BDDCACB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2608580404.000002621440C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926775706.000001B2C6FC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2921232065.000001B2C6928000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2609275400.0000026214AE2000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2828323869.000001DDE4DE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2921232065.000001B2C6959000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2924474756.000001A4073A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2933946577.0000015E3C417000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2827219433.000001DDE435B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821854743.000001DF82F8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2933946577.0000015E3C3EB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926775706.000001B2C6FCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2828323869.000001DDE4E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2835842751.000001DDFD4DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1820498326.000001DF811BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2924503092.000001B2C6BB0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2703342225.0000021126013000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2918487841.000001A406A7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2638542145.00000221ACC23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2608580404.00000262143C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2918487841.000001A406B01000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2933946577.0000015E3BCF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2637732373.00000221AC3D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2954879800.000001B2DFCA7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1825116949.000001DF9B8CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2956305413.000001A41FB50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.2560902012.00000262141B2000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2918487841.000001A406A70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2958992188.0000015E542F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1820498326.000001DF811B4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2828323869.000001DDE4C05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1749347665.0000000004441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2609356829.0000026214BB3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821854743.000001DF83035000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2962842731.0000015E54680000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2828323869.000001DDE4D1D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2926789320.0000015E3B274000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1820498326.000001DF811D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926775706.000001B2C7095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2637732373.00000221AC3D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2933946577.0000015E3BBF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2609356829.0000026214BA3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2638542145.00000221ACC33000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2703495802.0000021126200000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821201322.000001DF81530000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926775706.000001B2C7122000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2827025394.000001DDE42D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2927182354.000002BDDCB61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2927182354.000002BDDCB53000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1820498326.000001DF811D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2926789320.0000015E3B1F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926775706.000001B2C725F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2921232065.000001B2C695C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926775706.000001B2C6FE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2918270056.000002BDDC0AB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2637732373.00000221AC40B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2933946577.0000015E3BE92000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2921596858.000001A406D10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1820419607.000001DF81190000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2828323869.000001DDE4B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2701906266.0000023E082F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2638542145.00000221ACBB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2833724925.000001DDFD399000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2931929153.0000015E3B540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2827219433.000001DDE4320000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2918487841.000001A406AB4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2918270056.000002BDDC0ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2637651947.00000221AC390000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2984638251.00007FFDF1329000.00000004.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2964703030.000001A4209F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1825116949.000001DF9B905000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1820498326.000001DF811F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2911496485.000000C5B43E1000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1820498326.000001DF81221000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821854743.000001DF82F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926775706.000001B2C71C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1821284162.000001DF81550000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2910123007.00000014F27F0000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2927182354.000002BDDCA51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AteraAgent.exe PID: 7916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AteraAgent.exe PID: 8100, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 3132, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AgentPackageAgentInformation.exe PID: 5868, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AgentPackageAgentInformation.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AgentPackageAgentInformation.exe PID: 5516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AteraAgent.exe PID: 6400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cscript.exe PID: 5724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AgentPackageSTRemote.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AgentPackageMonitoring.exe PID: 5100, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DFCC6C8BB60B211B04.TMP, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DFBDF63F9E0954AA6F.TMP, type: DROPPED
Source: Yara match	File source: C:\Config.Msi\5323c1.rbs, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DFB522218AED2B124F.TMP, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSI438F.tmp-\AlphaControlAgentInstallation.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.ModelsV3.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DF1FF2901819542AF9.TMP, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DF49C6D83430A3FBE8.TMP, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSI25B4.tmp-\AlphaControlAgentInstallation.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSI619B.tmp-\AlphaControlAgentInstallation.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\inprogressinstallinfo.ipi, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSI2CD9.tmp-\AlphaControlAgentInstallation.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\System32\InstallUtil.InstallLog, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSI4584.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.CommonLib.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DF4EFA9AAB73D0778C.TMP, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe, type: DROPPED

Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

37_2_00007FFDF11DB9F0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	541 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	21 Windows Service	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	21 Windows Service	12 Process Injection	31 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Service Execution	Login Hook	Login Hook	1 Timestomp	NTDS	155 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	671 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	122 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	361 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Rundll32	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RQ--029.msi	19%	Virustotal		Browse
RQ--029.msi	24%	ReversingLabs	Win32.Trojan.Atera

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	26%	ReversingLabs	Win32.PUA.Atera
C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackage.Common.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.CommonLib.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.ModelsV3.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.Utils.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Dapper.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\ICSharpCode.SharpZipLib.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Microsoft.ApplicationInsights.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\NLog.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\OpenHardwareMonitorLib.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Polly.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\StructureMap.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Buffers.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Data.SQLite.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Diagnostics.DiagnosticSource.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Memory.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Runtime.CompilerServices.Unsafe.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Runtime.InteropServices.RuntimeInformation.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.ValueTuple.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\x64\SQLite.Interop.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\x86\SQLite.Interop.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Atera.AgentPackage.Common.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll	0%	ReversingLabs
C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll	0%	ReversingLabs
C:\Windows\Installer\MSI25B4.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI25B4.tmp-\AlphaControlAgentInstallation.dll	0%	ReversingLabs
C:\Windows\Installer\MSI25B4.tmp-\Microsoft.Deployment.WindowsInstaller.dll	0%	ReversingLabs
C:\Windows\Installer\MSI25B4.tmp-\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Windows\Installer\MSI25B4.tmp-\System.Management.dll	0%	ReversingLabs
C:\Windows\Installer\MSI2CD9.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI2CD9.tmp-\AlphaControlAgentInstallation.dll	0%	ReversingLabs
C:\Windows\Installer\MSI2CD9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	0%	ReversingLabs
C:\Windows\Installer\MSI2CD9.tmp-\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Windows\Installer\MSI2CD9.tmp-\System.Management.dll	0%	ReversingLabs
C:\Windows\Installer\MSI438F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI438F.tmp-\AlphaControlAgentInstallation.dll	0%	ReversingLabs
C:\Windows\Installer\MSI438F.tmp-\Microsoft.Deployment.WindowsInstaller.dll	0%	ReversingLabs
C:\Windows\Installer\MSI438F.tmp-\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Windows\Installer\MSI438F.tmp-\System.Management.dll	0%	ReversingLabs
C:\Windows\Installer\MSI4594.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4603.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI472D.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI619B.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI619B.tmp-\AlphaControlAgentInstallation.dll	0%	ReversingLabs
C:\Windows\Installer\MSI619B.tmp-\Microsoft.Deployment.WindowsInstaller.dll	0%	ReversingLabs
C:\Windows\Installer\MSI619B.tmp-\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Windows\Installer\MSI619B.tmp-\System.Management.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
d17kmd0va0f0mp.cloudfront.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.certplus.com/CRL/class3.crl0	0%	Avira URL Cloud	safe
http://microsoft.co	0%	Avira URL Cloud	safe
https://nlog-project.org/	0%	Avira URL Cloud	safe
http://nlog-project.org/ws/	0%	Avira URL Cloud	safe
http://wixtoolset.org	0%	Avira URL Cloud	safe
http://nlog-project.org/ws/ILogReceiverServer/ProcessLogMessagesT	0%	Avira URL Cloud	safe
https://system.data.sqlite.org/X	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class3.crl0	0%	Virustotal		Browse
http://www.w3.o	0%	Avira URL Cloud	safe
https://nlog-project.org/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ps.pndsn.com	13.232.67.198	true	false		high
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
d17kmd0va0f0mp.cloudfront.net	13.227.8.66	true	false	0%, Virustotal, Browse	unknown
d25btwd9wax8gu.cloudfront.net	52.222.144.9	true	false		high
cs2.wpc.gammacdn.net	152.199.23.209	true	false		high
a6dc35606b2c6816e.awsglobalaccelerator.com	52.223.39.232	true	false		high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		high
ps.atera.com	unknown	unknown	false		high
agent-api.atera.com	unknown	unknown	false		high
api.nuget.org	unknown	unknown	false		high
my.splashtop.com	unknown	unknown	false		high
download.splashtop.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=4001b75e-ef93-41e1-9164-a364993824c7&tr=31&tt=17339985815665640&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=76d4ae57-17bf-4f80-941f-dfaec85e70ea&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=a59345e3-8f8c-485b-a783-ef9be618e04a&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://my.splashtop.com/csrs/win	false	high
https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=9c4570a7-328a-4212-a79a-2c397f40b099&tr=31&tt=17339985948483535&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=e3c12418-7b83-4291-816c-71960a33cc91&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=add1eec0-31bb-44fb-a0b1-c0a51d202d6e&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://download.splashtop.com/csrs/Splashtop_Streamer_Win_DEPLOY_INSTALLER_v3.7.2.4.exe	false	high
https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=c49e3f86-ddea-4646-a660-d7eb89720c05&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=51a415c1-2b2c-4b67-8c44-1c23b5006966&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=97752f74-4e58-4d15-9e8f-db1d6f8f144c&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.atera.com/agentpackagesnet45/AgentPackageSTRemote/24.3/AgentPackageSTRemote.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+	false	high
https://ps.atera.com/agentpackagesnet45/AgentPackageUpgradeAgent/27.6/AgentPackageUpgradeAgent.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+	false	high
https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=fe41fefc-5f93-4d82-ae91-b2bfdba61e15&tr=31&tt=17339985948483535&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=12389298-6ae7-4f15-9ea9-0fb4b2954121&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=ad3557e3-084c-48ee-bd6c-1cfa8c684d4e&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=052b3658-a246-45af-9f6e-3245310762d8&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=7fbc5d09-98da-404d-b19a-f5bc553e8fdf&tr=31&tt=17339985948483535&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.atera.com/agentpackagesnet45/AgentPackageProgramManagement/26.3/AgentPackageProgramManagement.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+	false	high
https://ps.atera.com/agentpackagesnet45/AgentPackageMonitoring/37.8/AgentPackageMonitoring.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+	false	high
https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=251ddf58-e932-4891-bf1a-41fcf25995e8&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=5b0253c2-a85c-4e9c-930f-3ee261c0dba3&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=51a8a5d4-ca44-40cd-84d4-46bd929e2ce8&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=c2c17224-f7a0-412d-95aa-51f8282229db&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.atera.com/agentpackagesnet45/AgentPackageOsUpdates/20.9/AgentPackageOsUpdates.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+	false	high
https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=b54b0744-77ba-461d-8569-6e8a97c304cf&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6	false	high
https://ps.atera.com/agentpackagesnet45/AgentPackageInternalPoller/23.8/AgentPackageInternalPoller.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ps.atera.com/agentpackagesmac/AgentPackageWindowsUpdate/24.6/AgentPackageWindowsUpdate.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certplus.com/CRL/class3.crl0	AteraAgent.exe, 0000000D.00000002.2962842731.0000015E546DB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://agent-api.atera.com/Productio	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C6FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackageswin/AgentPackageSTRemote/16.0/AgentPackageSTRemote.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org	AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesnet45/AgentPackageMarketplace/1.6/AgentPackageMarketplace.zip	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesmac/Agen	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackageswin/AgentPackageInternalPoller/15.9/AgentPackageInternalPoller.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.pndsn.com/time/0?pnsdk=NET45CSharp6.13.0.0&requestid=01a07f47-4407-4c38-823d-6e5cc94bf07a	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agent-api.atera.com/Production/Agent/GetCommands)	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackageswin/AgentPackageUpgradeAgent/22.1/AgentPackageUpgradeAgent.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nlog-project.org/	AgentPackageMonitoring.exe, 00000025.00000002.2963004181.000001A41FE08000.00000002.00000001.01000000.00000025.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://agent-api.atera.com/Production/Agent/track-event	rundll32.exe, 00000004.00000002.1749347665.00000000044E4000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1749347665.0000000004441000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.0000000004954000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.00000000048B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dl.google.com/googletalk/googletalk-setup.exe	AgentPackageAgentInformation.exe, 00000015.00000000.2560902012.00000262141B2000.00000002.00000001.01000000.00000016.sdmp	false		high
https://ps.atera.com/agentpackagesmac/AgentPackageMarketplace/1.6/AgentPackageMarketplace.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agent-api.atera.com/Production/Agent/thresholds/14216fa6-dc15-4519-acf9-f0e1b34954b6	AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/System.ServiceProcess	AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagescrossplatform/AgentPackageMonitoring/0.40/AgentPackageMonitoring.z	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://wixtoolset.org	rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, RQ--029.msi, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, MSI472D.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://agent-api.atera.com/Production/Agent/track-event;	rundll32.exe, 00000004.00000002.1749347665.0000000004526000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.0000000004996000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackageswin/AgentPackageRuntimeInstaller/13.0/AgentPackageRuntimeInstaller	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	false		high
http://acontrol.atera.com/	AteraAgent.exe, 0000000C.00000000.1766473024.000001DF810F2000.00000002.00000001.01000000.0000000F.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BBF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C6FCC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agent-api.atera.com/Production/Agent/dynamic-fields/	AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4DE3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agent-api.atera.com/Production/Agent/AgentStarting)	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7122000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesnet45/AgentPackageADRemote/6.0/AgentPackageADRemote.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesnet45/AgentPackageTicketing/30.2/AgentPackageTicketing.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rundll32.exe, 00000004.00000002.1749347665.00000000044E4000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1749347665.0000000004441000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BBF1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.0000000004954000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.1883270062.00000000048B1000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000015.00000002.2609356829.0000026214BB3000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4DE3000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4B71000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C6FE2000.00000004.00000800.00020000.00000000.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCB61000.00000004.00000800.00020000.00000000.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.flexerasoftware.com0	SplashtopStreamer.exe.34.dr	false		high
https://ps.atera.com/agentpackagesmac/AgentPackageMonitoring/37.8/AgentPackageMonitoring.zip	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BC5E000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
http://my.splashtop.com	AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCBED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://microsoft.co	rundll32.exe, 00000011.00000002.1883870766.00000000070D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C710C000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackageswin/AgentPackageNetworkDiscovery/15.0/AgentPackageNetworkDiscovery	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesmac/AgentPackageHeartbeat/17.11/AgentPackageHeartbeat.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://download.splashtop.com	AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCC13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesnet45/AgentPackageTaskScheduler/17.2/AgentPackageTaskScheduler.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agent-api.atera.com	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7095000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70D6000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C6FE2000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7122000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C710C000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71C4000.00000004.00000800.00020000.00000000.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.nuget.org/packages/NLog.Web.AspNetCore	AgentPackageMonitoring.exe, 00000025.00000002.2963004181.000001A41FE08000.00000002.00000001.01000000.00000025.sdmp, AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	false		high
http://www.w3.oh	AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ac.economia.gob.mx/last.crl0G	AteraAgent.exe, 0000000D.00000002.2968403746.0000015E54856000.00000004.00000020.00020000.00000000.sdmp	false		high
https://agent-api.atera.com/Production/Agent/GetCommands	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BE6E000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7095000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nlog-project.org/ws/	AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	false	Avira URL Cloud: safe	unknown
https://ps.atera.com/agentpackagesnet45/AgentPackageTicketing/30.2/AgentPackageTicketing.zipX	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nlog-project.org/ws/ILogReceiverServer/ProcessLogMessagesT	AgentPackageMonitoring.exe, 00000025.00000002.2959923212.000001A41FD32000.00000002.00000001.01000000.00000025.sdmp	false	Avira URL Cloud: safe	unknown
https://urn.to/r/sds_see	System.Data.SQLite.dll.13.dr	false		high
https://ps.atera.com/agentpackagesmac/AgentPackageRuntimeInstaller/1.5/AgentPackageRuntimeInstaller.	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	false		high
https://my.splashtop.com	AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCBE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://system.data.sqlite.org/X	AgentPackageMonitoring.exe, 00000025.00000002.2964470827.000001A41FF34000.00000002.00000001.01000000.00000027.sdmp, System.Data.SQLite.dll.13.dr	false	Avira URL Cloud: safe	unknown
http://www.abit.com.tw/	AgentPackageMonitoring.exe, 00000025.00000002.2954222644.000001A41FAB2000.00000002.00000001.01000000.00000022.sdmp	false		high
https://agent-api.atera.com/Production/Agent/recurringCommandResult	AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4DB1000.00000004.00000800.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4D1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesnet45/AgentPackageAgentInformation/38.3/AgentPackageAgentInformati	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/installers/splashtop/win/SplashtopStreamer.exe	AgentPackageSTRemote.exe, 00000022.00000000.2669697402.000002BDDBED2000.00000002.00000001.01000000.0000001A.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2927182354.000002BDDCB61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesmac/AgentPackageTaskScheduler/13.0/AgentPackageTaskScheduler.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agent-api.P	AgentPackageAgentInformation.exe, 00000017.00000002.2828323869.000001DDE4DE3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.w3.o	AteraAgent.exe, 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ps.pndsn.com/v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4p	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/JamesNK/Newtonsoft.Json	rundll32.exe, 00000003.00000003.1680538318.0000000004C43000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1694532699.0000000004386000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1752210108.0000000004B5D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.1832739363.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, AgentPackageAgentInformation.exe, 00000015.00000002.2610139637.000002622D2A2000.00000002.00000001.01000000.00000019.sdmp, AteraAgent.exe, 0000001B.00000002.2952786726.000001B2DFA30000.00000002.00000001.01000000.00000020.sdmp, AgentPackageSTRemote.exe, 00000022.00000002.2924444903.000002BDDC982000.00000002.00000001.01000000.0000001F.sdmp, Newtonsoft.Json.dll1.13.dr, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll.4.dr	false		high
https://ps.pndsn.com/v2/subscrib	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7185000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesnet45/AgentPackageMonitoring/37.8/AgentPackageMonitoring.zip?JAAaE	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BE3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesmac/Agent.Package.Availability/0.16/Agent.Package.Availability.zip	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCB8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackageswin/AgentPackageMarketplace/13.0/AgentPackageMarketplace.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.pndsn	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7102000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71F6000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C71F0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesmac/AgentPackageAgentInformation/38.3/AgentPackageAgentInformation	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.sqlite.org/copyright.html2	AgentPackageMonitoring.exe, 00000025.00000002.2984783241.00007FFDF1334000.00000002.00000001.01000000.0000001C.sdmp, SQLite.Interop.dll.13.dr	false		high
https://ps.atera.com/agentpackagesnet45/Agent.Package.Watchdog/1.9/Agent.Package.Watchdog.zip	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCB8000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC4000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCF1000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7168000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesnet45/AgentPackageMonitoring/37.8/AgentPackageMonitoring.zip	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
HTTPS://PS.ATERA.COM/AGENTPACKAGESNET45/AGENTPACKAGEMONITORING/37.8/AGENTPACKAGEMONITORING.ZIP	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BE3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesnet45/AgentPackageInternalPoller/23.8/AgentPackageInternalPoller.z	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://system.data.sqlite.org/	AgentPackageMonitoring.exe, 00000025.00000002.2963387299.000001A41FED2000.00000002.00000001.01000000.00000027.sdmp, System.Data.SQLite.dll.13.dr	false		high
https://ps.atera.com/agentpackagesmac/AgentPackageUpgradeAgent/27.6/AgentPackageUpgradeAgent.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackageswin/AgentPackageMonitoring/22.0/AgentPackageMonitoring.zip	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BC5E000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCD0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp, AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagesmac/AgentPackageInternalPoller/13.0/AgentPackageInternalPoller.zip	AteraAgent.exe, 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ps.atera.com/agentpackagescrossplatform/AgentPackageSTRemote/2.6/AgentPackageSTRemote.zip	AteraAgent.exe, 0000000D.00000002.2933946577.0000015E3BCC0000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.222.144.9	d25btwd9wax8gu.cloudfront.net	United States	16509	AMAZON-02US	false
13.232.67.198	ps.pndsn.com	United States	16509	AMAZON-02US	false
13.227.8.66	d17kmd0va0f0mp.cloudfront.net	United States	16509	AMAZON-02US	false
52.223.39.232	a6dc35606b2c6816e.awsglobalaccelerator.com	United States	8987	AMAZONEXPANSIONGB	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573599
Start date and time:	2024-12-12 11:14:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RQ--029.msi
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winMSI@54/125@15/4
EGA Information:	Successful, ratio: 16.7%
HCA Information:	Successful, ratio: 63% Number of executed functions: 427 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 40.119.152.241, 199.232.210.172, 192.229.221.95, 20.60.197.1, 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): crl.edge.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, cacerts.digicert.com, agentsapi.trafficmanager.net, ctldl.windowsupdate.com, az320820.vo.msecnd.net, fe3cr.delivery.mp.microsoft.com, packagesstore.blob.core.windows.net, ocsp.digicert.com, atera-agent-api-eu.westeurope.cloudapp.azure.com, ocsp.edge.digicert.com, crl3.digicert.com, crl4.digicert.com, wu-b-net.trafficmanager.net, blob.ams08prdstr06a.store.core.windows.net, nugetapiprod.trafficmanager.net
Execution Graph export aborted for target AgentPackageAgentInformation.exe, PID 5516 because it is empty
Execution Graph export aborted for target AgentPackageAgentInformation.exe, PID 5868 because it is empty
Execution Graph export aborted for target AgentPackageSTRemote.exe, PID 6516 because it is empty
Execution Graph export aborted for target AteraAgent.exe, PID 6400 because it is empty
Execution Graph export aborted for target AteraAgent.exe, PID 7916 because it is empty
Execution Graph export aborted for target AteraAgent.exe, PID 8100 because it is empty
Execution Graph export aborted for target rundll32.exe, PID 3132 because it is empty
Execution Graph export aborted for target rundll32.exe, PID 7484 because it is empty
Execution Graph export aborted for target rundll32.exe, PID 7552 because it is empty
Execution Graph export aborted for target rundll32.exe, PID 7652 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:15:05	API Interceptor	2x Sleep call for process: rundll32.exe modified
05:15:11	API Interceptor	1452446x Sleep call for process: AteraAgent.exe modified
05:16:32	API Interceptor	65x Sleep call for process: AgentPackageAgentInformation.exe modified
05:16:41	API Interceptor	172x Sleep call for process: AgentPackageSTRemote.exe modified
05:17:02	API Interceptor	3x Sleep call for process: AgentPackageMonitoring.exe modified
10:17:18	Task Scheduler	Run new task: Monitoring Recovery path: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe s>schedulerrun

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
13.232.67.198	xUPaeKk5wQ.msi	Get hash	malicious	AteraAgent	Browse
	Infraccion-Multa.msi	Get hash	malicious	AteraAgent	Browse
	5c13e6.msi	Get hash	malicious	AteraAgent	Browse
	NF---710.msi	Get hash	malicious	AteraAgent	Browse
	registration.msi	Get hash	malicious	AteraAgent	Browse
	Digital.msi	Get hash	malicious	AteraAgent	Browse
	Guidelines_for_Citizen_Safety.msi	Get hash	malicious	AteraAgent	Browse
	e0#U05ea.msi	Get hash	malicious	AteraAgent	Browse
	ReceitaFederal-consulta-yFZMA-45896_v.3_35687.msi	Get hash	malicious	AteraAgent	Browse
52.223.39.232	Atualizador_Fiscal_NFe_37882912.msi	Get hash	malicious	AteraAgent	Browse
	Infraccion-Multa.msi	Get hash	malicious	AteraAgent	Browse
	setup (1).msi	Get hash	malicious	AteraAgent	Browse
	Le55bnMCON.msi	Get hash	malicious	AteraAgent	Browse
	kTbv9ZA2x0.msi	Get hash	malicious	AteraAgent	Browse
	IwmwOaVHnd.msi	Get hash	malicious	AteraAgent	Browse
	laudovisitabombeirosPdf.msi	Get hash	malicious	AteraAgent	Browse
	LaudoBombeirosPDF.msi	Get hash	malicious	AteraAgent	Browse
	SecuriteInfo.com.Program.RemoteAdminNET.1.4447.28224.msi	Get hash	malicious	AteraAgent	Browse
	Adobeflash.msi	Get hash	malicious	AteraAgent	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ps.pndsn.com	xUPaeKk5wQ.msi	Get hash	malicious	AteraAgent	Browse	13.232.67.198
	7gBUqzSN3y.msi	Get hash	malicious	AteraAgent	Browse	13.232.67.199
	nwindowsdll.msi	Get hash	malicious	AteraAgent	Browse	13.232.67.199
	5c13e6.msi	Get hash	malicious	AteraAgent	Browse	13.232.67.198
	NF---710.msi	Get hash	malicious	AteraAgent	Browse	13.232.67.199
	ListaItensVistoriaCorpodeBombeirosObrigatorio.msi	Get hash	malicious	AteraAgent	Browse	13.232.67.199
	registration.msi	Get hash	malicious	AteraAgent	Browse	13.232.67.198
	portal.msi	Get hash	malicious	AteraAgent	Browse	13.232.67.199
	Digital.msi	Get hash	malicious	AteraAgent	Browse	13.232.67.198
	file_66efd0132ceed.msi	Get hash	malicious	AteraAgent	Browse	13.232.67.199
bg.microsoft.map.fastly.net	DHL AWB Document_pdf.vbs	Get hash	malicious	Unknown	Browse	199.232.214.172
	Purchase_order-001.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	199.232.210.172
	MHDeXPq2uB.exe	Get hash	malicious	RedLine	Browse	199.232.210.172
	n70CrSGL8G.exe	Get hash	malicious	RedLine	Browse	199.232.214.172
	1.e	Get hash	malicious	DanaBot	Browse	199.232.210.172
	xuhu.exe	Get hash	malicious	AsyncRAT	Browse	199.232.210.172
	Review_Approval_rocjr.pdf	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	199.232.210.172
	https://computeroids.com/hp-printer-driver?utm_source=Google&utm_medium=Click&utm_campaign=HP&utm_term=%7Bkeywords%7D&utm_content=%7Bmedium%7D&tm=tt&ap=gads&aaid=adaHxflMmgPq7&camp_id=12260099411&ad_g_id=118845692873&keyword=install%20hp%20printer%20to%20computer&device=c&network=searchAd&adposition=&gad_source=5&gclid=EAIaIQobChMI0JDUvuabigMV_Uf_AR2MuQCMEAAYASAAEgKQMPD_BwE	Get hash	malicious	PureLog Stealer	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	199.232.210.172
d25btwd9wax8gu.cloudfront.net	xUPaeKk5wQ.msi	Get hash	malicious	AteraAgent	Browse	108.158.75.46
	7gBUqzSN3y.msi	Get hash	malicious	AteraAgent	Browse	108.158.75.93
	nwindowsdll.msi	Get hash	malicious	AteraAgent	Browse	108.158.75.12
	5c13e6.msi	Get hash	malicious	AteraAgent	Browse	108.158.75.4
	NF---710.msi	Get hash	malicious	AteraAgent	Browse	108.158.75.93
	ListaItensVistoriaCorpodeBombeirosObrigatorio.msi	Get hash	malicious	AteraAgent	Browse	108.158.75.46
	registration.msi	Get hash	malicious	AteraAgent	Browse	108.158.75.12
	portal.msi	Get hash	malicious	AteraAgent	Browse	108.158.75.46
	Digital.msi	Get hash	malicious	AteraAgent	Browse	108.158.75.4
	file_66efd0132ceed.msi	Get hash	malicious	AteraAgent	Browse	108.158.75.93

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZONEXPANSIONGB	SHIPPING DOCUMENTS_PDF.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	vFile__0054seconds__Arkansas.html	Get hash	malicious	Unknown	Browse	3.33.220.150
	Atualizador_Fiscal_NFe_37882912.msi	Get hash	malicious	AteraAgent	Browse	52.223.39.232
	https://drive.google.com/uc?export=download&id=1exrW4eArCFn4rWRiZm-_Z8vKtyu_rwNw	Get hash	malicious	HTMLPhisher	Browse	3.33.220.150
	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	https://hongkongliving.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	3.33.155.121
	Mozi.m.elf	Get hash	malicious	Mirai	Browse	3.50.46.176
	EFT Remittance_(Deerequipment)CQDM.html	Get hash	malicious	Unknown	Browse	3.33.220.150
	Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	http://abercombie.com	Get hash	malicious	Unknown	Browse	3.33.220.150
AMAZON-02US	RFQ_P.O.1212024.scr	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://url41.mailanyone.net/scanner?m=1tLLkn-000000000Cu-3MPx&d=4%7Cmail%2F90%2F1733919600%2F1tLLkn-000000000Cu-3MPx%7Cin41e%7C57e1b682%7C16739527%7C12325088%7C67598451340A7E7E34A434AD05811D2E&o=%2Fphts%3A%2Futs.s-wr-2petncotsio.etooop%2F.cmhser%3Fd%26.dv%3D2HHu%3D60cMaRtwLyzWIN9dDWQ0j0ZBOMkiZTWDNZlNTGFmj1MdNMhhZDGDZOROGjYu2uZVcIshL13m9bRZWmNz%3D0bwLhYN%26iQVjj%3DWgZ2MNNTwzmZZWIZJlWwW%3DFkM0%26tM2l121NaQSdK5YKQ3FWZeheTURUTubJOt2oOSTWgZtZT2BvQlNBQl%3DUSThT0%26lR04%3D4d05f88a4f83c102fc8d7af5079V%266bP%3DANdsFUUEk0NThTVVNScUSYWBBbgJ7rzlyn1ERkBSzh9qmzIX6xvrbsyM8qb6f4HC59eiDbrDsPv9W1mhDcOFm%23uMyW5bUaWm5iAtZ5cVujem228YFYt9&s=dQ2VS6ieQ8nkhuwt32k9X8A6qOU	Get hash	malicious	HTMLPhisher	Browse	13.227.8.58
	https://acg.citnow.com/dashboard	Get hash	malicious	Unknown	Browse	18.135.94.120
	mips.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	SHIPPING DOCUMENTS_PDF.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	jew.ppc.elf	Get hash	malicious	Unknown	Browse	18.226.64.181
	jew.mips.elf	Get hash	malicious	Unknown	Browse	52.52.10.186
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	54.195.68.141
	jew.arm6.elf	Get hash	malicious	Unknown	Browse	34.247.205.175
	https://newdocumentsproposal.webflow.io/	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	13.227.9.227
AMAZON-02US	RFQ_P.O.1212024.scr	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://url41.mailanyone.net/scanner?m=1tLLkn-000000000Cu-3MPx&d=4%7Cmail%2F90%2F1733919600%2F1tLLkn-000000000Cu-3MPx%7Cin41e%7C57e1b682%7C16739527%7C12325088%7C67598451340A7E7E34A434AD05811D2E&o=%2Fphts%3A%2Futs.s-wr-2petncotsio.etooop%2F.cmhser%3Fd%26.dv%3D2HHu%3D60cMaRtwLyzWIN9dDWQ0j0ZBOMkiZTWDNZlNTGFmj1MdNMhhZDGDZOROGjYu2uZVcIshL13m9bRZWmNz%3D0bwLhYN%26iQVjj%3DWgZ2MNNTwzmZZWIZJlWwW%3DFkM0%26tM2l121NaQSdK5YKQ3FWZeheTURUTubJOt2oOSTWgZtZT2BvQlNBQl%3DUSThT0%26lR04%3D4d05f88a4f83c102fc8d7af5079V%266bP%3DANdsFUUEk0NThTVVNScUSYWBBbgJ7rzlyn1ERkBSzh9qmzIX6xvrbsyM8qb6f4HC59eiDbrDsPv9W1mhDcOFm%23uMyW5bUaWm5iAtZ5cVujem228YFYt9&s=dQ2VS6ieQ8nkhuwt32k9X8A6qOU	Get hash	malicious	HTMLPhisher	Browse	13.227.8.58
	https://acg.citnow.com/dashboard	Get hash	malicious	Unknown	Browse	18.135.94.120
	mips.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	SHIPPING DOCUMENTS_PDF.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	jew.ppc.elf	Get hash	malicious	Unknown	Browse	18.226.64.181
	jew.mips.elf	Get hash	malicious	Unknown	Browse	52.52.10.186
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	54.195.68.141
	jew.arm6.elf	Get hash	malicious	Unknown	Browse	34.247.205.175
	https://newdocumentsproposal.webflow.io/	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	13.227.9.227
AMAZON-02US	RFQ_P.O.1212024.scr	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://url41.mailanyone.net/scanner?m=1tLLkn-000000000Cu-3MPx&d=4%7Cmail%2F90%2F1733919600%2F1tLLkn-000000000Cu-3MPx%7Cin41e%7C57e1b682%7C16739527%7C12325088%7C67598451340A7E7E34A434AD05811D2E&o=%2Fphts%3A%2Futs.s-wr-2petncotsio.etooop%2F.cmhser%3Fd%26.dv%3D2HHu%3D60cMaRtwLyzWIN9dDWQ0j0ZBOMkiZTWDNZlNTGFmj1MdNMhhZDGDZOROGjYu2uZVcIshL13m9bRZWmNz%3D0bwLhYN%26iQVjj%3DWgZ2MNNTwzmZZWIZJlWwW%3DFkM0%26tM2l121NaQSdK5YKQ3FWZeheTURUTubJOt2oOSTWgZtZT2BvQlNBQl%3DUSThT0%26lR04%3D4d05f88a4f83c102fc8d7af5079V%266bP%3DANdsFUUEk0NThTVVNScUSYWBBbgJ7rzlyn1ERkBSzh9qmzIX6xvrbsyM8qb6f4HC59eiDbrDsPv9W1mhDcOFm%23uMyW5bUaWm5iAtZ5cVujem228YFYt9&s=dQ2VS6ieQ8nkhuwt32k9X8A6qOU	Get hash	malicious	HTMLPhisher	Browse	13.227.8.58
	https://acg.citnow.com/dashboard	Get hash	malicious	Unknown	Browse	18.135.94.120
	mips.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	SHIPPING DOCUMENTS_PDF.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	jew.ppc.elf	Get hash	malicious	Unknown	Browse	18.226.64.181
	jew.mips.elf	Get hash	malicious	Unknown	Browse	52.52.10.186
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	54.195.68.141
	jew.arm6.elf	Get hash	malicious	Unknown	Browse	34.247.205.175
	https://newdocumentsproposal.webflow.io/	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	13.227.9.227

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	3d#U0438.hta	Get hash	malicious	Unknown	Browse	52.222.144.9 13.232.67.198 13.227.8.66 52.223.39.232
	Agreement for Cooperation.PDF.lnk.download.lnk	Get hash	malicious	RedLine	Browse	52.222.144.9 13.232.67.198 13.227.8.66 52.223.39.232
	RFQ-004282A.Teknolojileri A.S.exe	Get hash	malicious	AgentTesla	Browse	52.222.144.9 13.232.67.198 13.227.8.66 52.223.39.232
	Strait STS.vbs	Get hash	malicious	Remcos, GuLoader	Browse	52.222.144.9 13.232.67.198 13.227.8.66 52.223.39.232
	Shipping Documents.exe	Get hash	malicious	MassLogger RAT	Browse	52.222.144.9 13.232.67.198 13.227.8.66 52.223.39.232
	https://computeroids.com/hp-printer-driver?utm_source=Google&utm_medium=Click&utm_campaign=HP&utm_term=%7Bkeywords%7D&utm_content=%7Bmedium%7D&tm=tt&ap=gads&aaid=adaHxflMmgPq7&camp_id=12260099411&ad_g_id=118845692873&keyword=install%20hp%20printer%20to%20computer&device=c&network=searchAd&adposition=&gad_source=5&gclid=EAIaIQobChMI0JDUvuabigMV_Uf_AR2MuQCMEAAYASAAEgKQMPD_BwE	Get hash	malicious	PureLog Stealer	Browse	52.222.144.9 13.232.67.198 13.227.8.66 52.223.39.232
	https://owotabua.cloudfederalservices.com/F3A4k	Get hash	malicious	Unknown	Browse	52.222.144.9 13.232.67.198 13.227.8.66 52.223.39.232
	https://securee103.z13.web.core.windows.net/winside/00Windbndktw0win11advance/index.html#	Get hash	malicious	TechSupportScam	Browse	52.222.144.9 13.232.67.198 13.227.8.66 52.223.39.232
	c2.hta	Get hash	malicious	XWorm	Browse	52.222.144.9 13.232.67.198 13.227.8.66 52.223.39.232

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll	Atualizador_Fiscal_NFe_37882912.msi	Get hash	malicious	AteraAgent	Browse
	xUPaeKk5wQ.msi	Get hash	malicious	AteraAgent	Browse
	7gBUqzSN3y.msi	Get hash	malicious	AteraAgent	Browse
	nwindowsdll.msi	Get hash	malicious	AteraAgent	Browse
	Infraccion-Multa.msi	Get hash	malicious	AteraAgent	Browse
	5c13e6.msi	Get hash	malicious	AteraAgent	Browse
	NF---710.msi	Get hash	malicious	AteraAgent	Browse
	ListaItensVistoriaCorpodeBombeirosObrigatorio.msi	Get hash	malicious	AteraAgent	Browse
	registration.msi	Get hash	malicious	AteraAgent	Browse
	portal.msi	Get hash	malicious	AteraAgent	Browse
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	Atualizador_Fiscal_NFe_37882912.msi	Get hash	malicious	AteraAgent	Browse
	xUPaeKk5wQ.msi	Get hash	malicious	AteraAgent	Browse
	7gBUqzSN3y.msi	Get hash	malicious	AteraAgent	Browse
	nwindowsdll.msi	Get hash	malicious	AteraAgent	Browse
	Infraccion-Multa.msi	Get hash	malicious	AteraAgent	Browse
	5c13e6.msi	Get hash	malicious	AteraAgent	Browse
	NF---710.msi	Get hash	malicious	AteraAgent	Browse
	ListaItensVistoriaCorpodeBombeirosObrigatorio.msi	Get hash	malicious	AteraAgent	Browse
	registration.msi	Get hash	malicious	AteraAgent	Browse
	portal.msi	Get hash	malicious	AteraAgent	Browse

Created / dropped Files

C:\Config.Msi\5323c1.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	8807
Entropy (8bit):	5.659752859791927
Encrypted:	false
SSDEEP:	192:2jHxz1ccbTOOeMeab61G7r6IHfG7r6kAVv70HVotBVeZEmzmYpLAV775XpY92r:2rD2vSpStiB2il
MD5:	A5E616E5FBE53352A3D34F55EE4D18FE
SHA1:	C67404F944B69B407323B71089A1890726D856B4
SHA-256:	6F42D3DB36356B034F986FA8028EED1F1B38B0EFBB51ADC4CEB2B9C62239B5A5
SHA-512:	CEFF99E0FA08BAD3A07B38953F088AC3CC8A613C2B9DD89D219EC8092A0BABF1D3EBF12BE56A327855530659B1C244A94962C9C0DD297DCF235BB5205028F5F9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Config.Msi\5323c1.rbs, Author: Joe Security
Preview:	...@IXOS.@.....@.).Y.@.....@.....@.....@.....@.....@......&.{E732A0D7-A2F2-4657-AC41-B19742648E45}..AteraAgent..RQ--029.msi.@.....@.....@.....@........&.{721AD955-79FD-4019-BBF5-9DCC4C1175BB}.....@.....@.....@.....@.......@.....@.....@.......@......AteraAgent......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....StopAteraServiceQuiet....KillAteraTaskQuiet....ProcessComponents..Updating component registration..&.{F7DFE9BA-9FAD-11DA-9578-00E08161165F}&.{E732A0D7-A2F2-4657-AC41-B19742648E45}.@......&.{C8C868DC-3A5E-4180-A7BB-03D6282966CB}&.{E732A0D7-A2F2-4657-AC41-B19742648E45}.@......&.{0EC8B23C-C723-41E1-9105-4B9C2CDAD47A}&.{E732A0D7-A2F2-4657-AC41-B19742648E45}.@......&.{F1B1B9D1-F1B0-420C-9D93-F04E9BD4795D}&.{E732A0D7-A2F2-4657-AC41-B19742648E45}.@......&.{5F95F700-DCA4-4880-B2D2-891AE0D6E1A3}&.{E732A0D7-A2F2-4657-AC41-B19742648E45}.@......&.{F62C52BA-15C7-4C3D-AAB2-DE65004F9665}&.{E732A0D7-A2F2-4657-AC41-B19742648E45}.@......&.{38F01010-E311-4

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.853078320826549
Encrypted:	false
SSDEEP:	12:qLLYem7haYNem7hcomf3em7hUQLtygXnC9xkKxeCsx/Yem7haYNem7hcomf3em7B:qLUVhzVhM3VhdLtXXIxkKxeCsOVhzVhY
MD5:	8298451E4DEE214334DD2E22B8996BDC
SHA1:	BC429029CC6B42C59C417773EA5DF8AE54DBB971
SHA-256:	6FBF5845A6738E2DC2AA67DD5F78DA2C8F8CB41D866BBBA10E5336787C731B25
SHA-512:	CDA4FFD7D6C6DFF90521C6A67A3DBA27BF172CC87CEE2986AE46DCCD02F771D7E784DCAD8AEA0AD10DECF46A1C8AE1041C184206EC2796E54756E49B9217D7BA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog, Author: Joe Security
Preview:	.Installing assembly 'C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe'...Affected parameters are:.. logtoconsole = .. assemblypath = C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.. logfile = C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog..Installing service AteraAgent.....Service AteraAgent has been successfully installed...Creating EventLog source AteraAgent in log Application.....Committing assembly 'C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe'...Affected parameters are:.. logtoconsole = .. assemblypath = C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.. logfile = C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog..

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (7463), with no line terminators
Category:	dropped
Size (bytes):	7466
Entropy (8bit):	5.1606801095705865
Encrypted:	false
SSDEEP:	96:R3DrP/zatgCnNjn1x62muDr9aHmzcv/65m7JDcm0BefnanGEkn56vT4ZvR++JDr+:NexdYX7OSRjXsaA0Ndhi
MD5:	362CE475F5D1E84641BAD999C16727A0
SHA1:	6B613C73ACB58D259C6379BD820CCA6F785CC812
SHA-256:	1F78F1056761C6EBD8965ED2C06295BAFA704B253AFF56C492B93151AB642899
SHA-512:	7630E1629CF4ABECD9D3DDEA58227B232D5C775CB480967762A6A6466BE872E1D57123B08A6179FE1CFBC09403117D0F81BC13724F259A1D25C1325F1EAC645B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><ArrayOfKeyValueOfanyTypeanyType xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:x="http://www.w3.org/2001/XMLSchema" z:Id="1" z:Type="System.Collections.Hashtable" z:Assembly="0" xmlns:z="http://schemas.microsoft.com/2003/10/Serialization/" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><LoadFactor z:Id="2" z:Type="System.Single" z:Assembly="0" xmlns="">0.72</LoadFactor><Version z:Id="3" z:Type="System.Int32" z:Assembly="0" xmlns="">2</Version><Comparer i:nil="true" xmlns="" /><HashCodeProvider i:nil="true" xmlns="" /><HashSize z:Id="4" z:Type="System.Int32" z:Assembly="0" xmlns="">3</HashSize><Keys z:Id="5" z:Type="System.Object[]" z:Assembly="0" z:Size="2" xmlns=""><anyType z:Id="6" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays">_reserved_nestedSavedStates</anyType><anyType z:Id="7" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/20

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	145968
Entropy (8bit):	5.874150428357998
Encrypted:	false
SSDEEP:	3072:bk/SImWggsVz8TzihTmmrG/GOXYsqRK3ybTXzpUTQM9/FMp:ISWB/YrRK3yb37
MD5:	477293F80461713D51A98A24023D45E8
SHA1:	E9AA4E6C514EE951665A7CD6F0B4A4C49146241D
SHA-256:	A96A0BA7998A6956C8073B6EFF9306398CC03FB9866E4CABF0810A69BB2A43B2
SHA-512:	23F3BD44A5FB66BE7FEA3F7D6440742B657E4050B565C1F8F4684722502D46B68C9E54DCC2486E7DE441482FCC6AA4AD54E94B1D73992EB5D070E2A17F35DE2F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Joe Sandbox View:	Filename: Atualizador_Fiscal_NFe_37882912.msi, Detection: malicious, Browse Filename: xUPaeKk5wQ.msi, Detection: malicious, Browse Filename: 7gBUqzSN3y.msi, Detection: malicious, Browse Filename: nwindowsdll.msi, Detection: malicious, Browse Filename: Infraccion-Multa.msi, Detection: malicious, Browse Filename: 5c13e6.msi, Detection: malicious, Browse Filename: NF---710.msi, Detection: malicious, Browse Filename: ListaItensVistoriaCorpodeBombeirosObrigatorio.msi, Detection: malicious, Browse Filename: registration.msi, Detection: malicious, Browse Filename: portal.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..e.........."...0.............f$... ...@....@.. ...............................1....`..................................$..O....@..,...............0(...`......."............................................... ............... ..H............text...\|.... ...................... ..`.rsrc...,....@......................@..@.reloc.......`......................@..B................H$......H.......(...D4..........l!..p.............................................{.....0..N........~......,.~.....+:(.......~....(........(....#.......@....,.(.....+.~.....+.....0..;........(.......(.....1.(.......(........+....,.~.....+.~.....+....0..6........~....%-.&~..........s....%.....s ......o!.....o".......0..O........(...........~#...r...po$..........,..rG..ps%...z.rO..p.....(&....~.....o'....*..0..>........~#...r...po(............,'.~#...r...po$............,.rG..ps%...

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1442
Entropy (8bit):	5.076953226383825
Encrypted:	false
SSDEEP:	24:JdfrdB2nk3Jc3J4YH33Jy34OqsJ+J4YHKJy34OOAPF7NhOXrRH2/d9r:3frf2nKS4YHJyILsJ+J4YHKJyIv47O7w
MD5:	B3BB71F9BB4DE4236C26578A8FAE2DCD
SHA1:	1AD6A034CCFDCE5E3A3CED93068AA216BD0C6E0E
SHA-256:	E505B08308622AD12D98E1C7A07E5DC619A2A00BCD4A5CBE04FE8B078BCF94A2
SHA-512:	FB6A46708D048A8F964839A514315B9C76659C8E1AB2CD8C5C5D8F312AA4FB628AB3CE5D23A793C41C13A2AA6A95106A47964DAD72A5ECB8D035106FC5B7BA71
Malicious:	true
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" /></startup>.... <appSettings>.. .. .. .. <add key="ClientSettingsProvider.ServiceUri" value="" />.. </appSettings>.. .. .. <system.web>.. <membership defaultProvider="ClientAuthenticationMembershipProvider">.. <providers>.. <add name="ClientAuthenticationMembershipProvider" type="System.Web.ClientServices.Providers.ClientFormsAuthenticationMembershipProvider, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" serviceUri="" />.. </providers>.. </membership>.. <roleManager defaultProvider="ClientRoleProvider" enabled="true">.. <providers>.. <add name="ClientRoleProvider" type="System.Web.ClientServices.Providers.ClientRoleProvider, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" serviceUri="" cacheTimeout="86

C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3318832
Entropy (8bit):	6.534876879948643
Encrypted:	false
SSDEEP:	49152:yIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9p:DBbBWIgWljGxRB/LLp
MD5:	11CC798BAFA45BE12D27C68D6B59BA27
SHA1:	4D1CA0C0F1BC3691F5F852CC8D3ED88605B70434
SHA-256:	443A1C088E62810A954FFE9F0136F7A8D5E44928425D23B5284D936270D9837A
SHA-512:	FA0AEAF5309FD1593DB8AF774F18AA9CDA9B7ABD3F32D34CFD1B615EE68CECA0155DFB0AB7351E182B1B9D872BF41B19E66D2B597D2BA6300AF332A0F525C75A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Atualizador_Fiscal_NFe_37882912.msi, Detection: malicious, Browse Filename: xUPaeKk5wQ.msi, Detection: malicious, Browse Filename: 7gBUqzSN3y.msi, Detection: malicious, Browse Filename: nwindowsdll.msi, Detection: malicious, Browse Filename: Infraccion-Multa.msi, Detection: malicious, Browse Filename: 5c13e6.msi, Detection: malicious, Browse Filename: NF---710.msi, Detection: malicious, Browse Filename: ListaItensVistoriaCorpodeBombeirosObrigatorio.msi, Detection: malicious, Browse Filename: registration.msi, Detection: malicious, Browse Filename: portal.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R............" ..0..r2..........&1.. ....2...... ........................2.....i.3...@.................................G&1.O.....2..............\|2.0(....2.....X.(.p............................................ ............... ..H............text....p2.. ...r2................. ..`.rsrc.........2......t2.............@..@.reloc........2......z2.............@..B................{&1.....H...........$....................(.....................................V!........s..........~....-(....o....o....o.........~....-.~.........~......( ......0..G.......(!....o"....s.1....s,..%..(.... ....o.....o 0...Zo....t....o8(..(......0..$..........(.....(....o.....(!.......io#...z...(....(!....o"...o....(......0............T....r...p.(O....o$....(......0..I.......sG...sB)..s.(..s.(...(....s6(....,..o%....2...(....sV(....+.....%..ox.....( ...*V.(&.....}......}..

C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	215088
Entropy (8bit):	6.030864151731967
Encrypted:	false
SSDEEP:	6144:r1uYsjrFIzmuxpOI/1MvCdRbpSISC8j7s/k:mIzm6pOIgvr7ok
MD5:	C106DF1B5B43AF3B937ACE19D92B42F3
SHA1:	7670FC4B6369E3FB705200050618ACAA5213637F
SHA-256:	2B5B7A2AFBC88A4F674E1D7836119B57E65FAE6863F4BE6832C38E08341F2D68
SHA-512:	616E45E1F15486787418A2B2B8ECA50CACAC6145D353FF66BF2C13839CD3DB6592953BF6FEED1469DB7DDF2F223416D5651CD013FB32F64DC6C72561AB2449AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............'... ...@....... ....................................`..................................'..O....@..t............ ..0(...`.......&..T............................................ ............... ..H............text........ ...................... ..`.rsrc...t....@......................@..@.reloc.......`......................@..B.................'......H........... ...................$&........................................( ..."..(!...&...("...&...(#...2.r...p(...."..(....&...(....&...(....2.rE..p(...."..(....&...(....&...(....2.r...p(...."..(....&...(....&...(....J..r...p($...(....v....(%.....(%.....(%...(........L...%...%.r...p.%...%.r...p.%....%.r+..p.%...(&...(......(....&...(....&...(.....0..)........{.........('...t......\|......(...+...3.....0..)........{.........()...t......\|......(...+...3.

C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	710192
Entropy (8bit):	5.96048066969898
Encrypted:	false
SSDEEP:	12288:3BARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTUU:3BA/ZTvQD0XY0AJBSjRlXP36RMGV
MD5:	2C4D25B7FBD1ADFD4471052FA482AF72
SHA1:	FD6CD773D241B581E3C856F9E6CD06CB31A01407
SHA-256:	2A7A84768CC09A15362878B270371DAAD9872CAACBBEEBE7F30C4A7ED6C03CA7
SHA-512:	F7F94EC00435466DB2FB535A490162B906D60A3CFA531A36C4C552183D62D58CCC9A6BB8BBFE39815844B0C3A861D3E1F1178E29DBCB6C09FA2E6EBBB7AB943A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D.}..........." ..0.................. ........... ....................... ......J.....`.....................................O.......................0(.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......d....9..................h.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	Zip archive data, at least v4.5 to extract, compression method=deflate
Category:	dropped
Size (bytes):	384894
Entropy (8bit):	7.999386459973609
Encrypted:	true
SSDEEP:	6144:v5tKfF+xcaAeibHkWm83Bb5HKVP92+imBs7H8dPkoFuvjQ2AhWy90sW1WTHHVwM9:htUF+xcsibbLLPUWOPkeuU2AsyjW15PE
MD5:	ABA4C6047CFEC27B6DB13E0F103F4BDB
SHA1:	916CB99BF2828286034BA6EF63891AABA24770EF
SHA-256:	B88271E1A2DF3FB14FA862922ECE74E403C6135DDE18BD58EE1F2003992F1D38
SHA-512:	6AD7D25781EDD630E2DD187A2523ACD3623ADA5AF5BBB822AEDE3643BA4A04E191B7E2B31DE78E362B9AC44A38A917B19C19FEBEA4EBC1E963F9F85BEA61DCA6
Malicious:	false
Preview:	PK..-.....u..Y..p.........=...AgentPackageAgentInformation/AgentPackageAgentInformation.exe....(.......8..........J..0....:........ggZ.......(;4jy.../...l...B...J....,..7;.2a..z.^.....d.....R.....B....U6-.j.D.}..7(..O...{<...^...R...$X.......g.u..C".............U...;...K...{C....k......MA0..$.X.JK@>Q.omT;.......6...%H..L...\|.u"w...y.$.\|].m.X/0.Ev.c$....X.;@...$^L...g$...-.t...z>a..8g\|O.K..b.?f?.......b........lsJ.0..{zV1..U....=..C$..8a.....@(..s.r...k.....6....op.%....Z.!.7M3.C.>.aH.BS..?lB...SW...h.......hB...cT^uI1o..'x..eq)5@.[....$.]......1.LPx.....Q..{z..Ynm......OKr.S.S$z..4..a.D..R........2$...5B...;S..Ys...a....h.. .M..e.M...>...P,..Q.H.P.Yj.).I.y..ZC\|S...'..U.]..r.".vA....n.>#...1.v..,Q.i.... ..u.p$.b.?...8<..v..o..Sf<r.Cx.C.'.#3.RL..kw.,..(Wz...L'..@..]K..z...E.....a....a...kG.P..#.D.....DKp.{;.\...R....Hp]...m<5.6.sjq...!.55.....\|8...j...F...Lp.I...../......Q..VR.0x..`.j...j......%qc..2......WG...7_.d.V....7)@g..~.8M..=......

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	178728
Entropy (8bit):	5.825238453021458
Encrypted:	false
SSDEEP:	3072:hEEm/xCr5UQFKa2kf9ZSf4aP8gCko0Dcm:hE7/xCwa2C9ZAt
MD5:	83FD950ED584099A4125EFBA77E26BAA
SHA1:	C686501C1CDE18346B237C83450333E95570B844
SHA-256:	073E4CB181DF1D54B75277A52356A8D42573D61E878710BACDA8F2B0931D08A1
SHA-512:	C933C7C1FA3DEFE69CB1A86193A04533068C3695DCC14B235DA9E9342C5A81245060C72669069F2A06410DE7AEA1CABDFBC41B410353C597A731250E00CCBE93
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M.Tg.........."...0.............".... ........@.. ..............................i.....`....................................O.......................((........................................................... ............... ..H............text...p.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H....... ...x.......,....................................................0..........r...p... .....r...p.(.....o......(.....o......(.....o...........s......[o .....s!...%.o".......o#.....s$..........s%...%......io&...%o'.....o(.......o)...o).....(.....0..........r...p... .....r...p.(.....o......(.....o.......(+..........s......[o .....s!...%.o".......o,.......s-..........s%......i.l.....%......io........o)...o)...(.........o/.....(0.....{...."..}......{...."..}......{.

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	546
Entropy (8bit):	5.048902065665432
Encrypted:	false
SSDEEP:	12:MMHdG3VSQg9LNFF7ap+5v5OXrRf/2//FicYo4xm:JdASPF7NhOXrRH2/d9r
MD5:	158FB7D9323C6CE69D4FCE11486A40A1
SHA1:	29AB26F5728F6BA6F0E5636BF47149BD9851F532
SHA-256:	5E38EF232F42F9B0474F8CE937A478200F7A8926B90E45CB375FFDA339EC3C21
SHA-512:	7EEFCC5E65AB4110655E71BC282587E88242C15292D9C670885F0DAAE30FA19A4B059390EB8E934607B8B14105E3E25D7C5C1B926B6F93BDD40CBD284AAA3CEB
Malicious:	true
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>...<supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>..

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.ini

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:WhWYn:WB
MD5:	F647BC6B4E05B062BDE5A2F379B438BE
SHA1:	17FFC1B640A9AD0A8DC087CCA6C99478197EBAA0
SHA-256:	5F46695D90CFFB577A2961A23BE6DFAC09B39BFB2B9CBA13E5327407EE3557B6
SHA-512:	7EDB51CEFC77A67EF55093AA31D5C8AC899A6681D53AE6300132D851644CB15A0762511C61378C4C8C8C02A1B83A704E834C627B0998673085357A04599280AF
Malicious:	false
Preview:	version=38.3

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	96808
Entropy (8bit):	6.1801112962149105
Encrypted:	false
SSDEEP:	1536:sJt7dqUlizL21LDdeOKTfLz2L506wFj/XxFoKjhJG/50vks00UfgfgvO1762OO:sQUm2H5KTfOLgxFJjE50vksVUfPvO1YO
MD5:	14FCB3F21FFC0FF3FA9F3C1CDEEFAE9D
SHA1:	6FD620BFC789F753E52E458A01E9522F3651E30B
SHA-256:	4C9AC64A4044D378D198A4371C7B346F891BF649EF21104440B8B4106AD0494C
SHA-512:	F3AE77B31184EDBA0AD2C97035AA96D2A28C77EBEF1CA7B4F26751DA606D2A0C9E0C636D51B44E1984BF6FEF3BECE596EA3CEDF3F901276CC61718AD3B20CFC7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.d.........." ..0..H..........zf... ........... ..............................{.....`.................................(f..O.......8............R..((...........d............................................... ............... ..H............text....F... ...H.................. ..`.rsrc...8............J..............@..@.reloc...............P..............@..B................\f......H........k..D............................................................0..>.......~........o....~......(....&.s.......&...~....(....,..(....&.............$...........'........(............0..4.......(....o....r...p(....r...p(..........(....(......&..........00......:.(......}......0..Z............( ...,......(!...~..........("........( ...-..(....s#...........,..($.........(!...*..........&E.......0..G........{....,.(......5~%...r'..po&...rm..pr...po'...tR...r...p((..

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	704552
Entropy (8bit):	5.953924597885397
Encrypted:	false
SSDEEP:	12288:r9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3g:r8m657w6ZBLmkitKqBCjC0PDgM5w
MD5:	E337926D73F2A989AAAEE4C76709B750
SHA1:	11236A81C756E4137BC9400B62A93C4A2FA16BC1
SHA-256:	95E8D460402889DB8D3A87E4AAD117DCF829AB4FDCFB5B53589325E7DEDA7EB4
SHA-512:	ACDF3121F79BDC7ECE72D9539BFD3CD0436F406529EDC1D92ACB16A1EA212FFEEADD1839A38F013FE898F2B23B9CCC92C4A7DDBFFCD7B6F808388307072AAF7F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ...................................`.....................................O.......................((.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........{...,..................d.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{^....3...{]......(....,...{].....{_.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\dynamicfieldscaching.cch

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	4.663575178423969
Encrypted:	false
SSDEEP:	12:hsShKY4MsShLP6SX9NfzyShaKf0OJGShaKf0Od:P4qBX9Nf1zd
MD5:	316E5043F12AD02A5FD8EDE74FA9CB21
SHA1:	76EFB4FC79C8A40AB3BA895C2896248E362922BD
SHA-256:	C371D84982FABE32E9424ABB22AC0CCFFB7B693E49EDA08FE7805ACCBFA1BDE8
SHA-512:	08C62E2049B3CF2247D12510578217AA1CD7E905F0B33FF3157BFA631FE27C5EB48E31643A7FF597663F28FF5E64145421F94B652581BEC43362AAFBF5AB1393
Malicious:	false
Preview:	......................TAgentPackageAgentInformation, Version=38.3.0.0, Culture=neutral, PublicKeyToken=null.....6AgentPackageAgentInformation.Cache.CachedDynamicFields.....<DynamicFields>k__BackingField.<Timestamp>k__BackingField..JAgentPackageAgentInformation.Api.Information.CustomField.DynamicFieldDto[].....................H...............HAgentPackageAgentInformation.Api.Information.CustomField.DynamicFieldDto................................................................................................

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\information.cch

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	3.875731503204188
Encrypted:	false
SSDEEP:	3:bj6nV+dJO/n:sV+sn
MD5:	548F708A1679DEA424A810AD2CC4F45E
SHA1:	95B417651782A3D52A761C68CCFD1DE1CE1D7A12
SHA-256:	1BDC9E2675ECEF0ADEDD8EC2E11AA4B0556EE4E3FF869A28B0767E6BD49D7579
SHA-512:	E6D2BAC827A851C83CAD05D9D0AF5030388D628A22D077723340F6A7D6C7341BCA5D5B36D63A3FDAFB592C9FEA8D4A1EC463E92E0874CB155D031969CA5AC441
Malicious:	false
Preview:	.32E15221649B0ACC8A1B6123329C80D6

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\update.cch

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	3.677028119136097
Encrypted:	false
SSDEEP:	3:fc3Gh7UgzVchXn:f7NUgWn
MD5:	E49A5284D2F384905389D53944708C48
SHA1:	E455420E95EA0246B8B63A251B0E451ACD711B28
SHA-256:	33FD3B161AEC8867652C6B0707180ADC42C267EE9F66E33BF0CE70B55B4660B9
SHA-512:	E9EC60296F38F68EB6C6233094E50EF534CE44A91E6511097158D631673017F8FE316E1C11A494C29BD8BE6F94AAFBF9F4A9546E709694BD3CC98B12CD243FF4
Malicious:	false
Preview:	.2E69DDAE9D0D04A8ED39EECA359A9772

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	Zip archive data, at least v4.5 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3585766
Entropy (8bit):	7.9999279847863685
Encrypted:	true
SSDEEP:	98304:XOzuWD7XM4OvRQW56YWuCrMXa7ANNBvlXWKCI:XauWD7cjGKWuyOr
MD5:	E010D1F614B1A830482D3DF4BA056F24
SHA1:	5873E22B8C51A808C06A3BBF425FCF02B2A80328
SHA-256:	98A98DD1DF25D31A01D47EAF4FA65D5F88BC0AD166F8F31D68F2994B4F739A9B
SHA-512:	727877929530E08062611868FD751D1B64E4C7D28C26B70F14C7CD942B1AE1579CBA2A2EF038BAD07032EF728AE277963FFB3E1AB7A5C28351326FABAD84DAA6
Malicious:	false
Preview:	PK..-......6>Y.^.S........1...AgentPackageMonitoring/AgentPackageMonitoring.exe....0........p........_L........v.w.../.E..l1.=.8..F.....\|..%J.....QB..+.C#.(...Y..FC.j./.?..#WJ.T......3.P....7^p5.g.`.. .m.h..U..(\.OlC.U...,...l~..Noh.q....Ai.'.EuZ..!z..5w4..&..4..b.__...7u..^.Wv.1.:.\|....}..I....F..W..Ko]_j.mk..v..-....CW.....%x....&...o.:I.~.C..#%S..U...f$..n.........WE.....>...d...._M.\|....(..?..i. Z.d......{..C.P....57.QR...._iN...r.t..IG..tFs..r.%..b.I.C......`Dd..8U.h..T.C..q....7.i.L..S!m"..).s."..H....W..b....X.l.C..'..#M....gB}k4..{K.&..s.<.^..Q....Q..c..&..BO..W.".\...!.CR..,o<.X>....,.-.[.^1H^r.)q. L..#.?...0..j.,r.`#..Rq"K/.B.:.....V...hX_..ja.........[.)&....C...../../......IZ2..v .@G...F....nf. .@w.9o.,.....X.i.K/.}\!..7.a.w....:.x.$gE..DG..V...t...K...M.$...b..{.u.4..1..]."..o.n8dQ<...q.....d.(..Y...U...../n.....*y+..%.+.D.}W.&&.U.Z...c#.mU(.......d(.......x....r".g/O.....5..\|(p..XG...'7].3.A.Y.&.&D$.".\|...D..d\.

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	398384
Entropy (8bit):	6.2554691460003795
Encrypted:	false
SSDEEP:	6144:OLrnDNjiDx+xdShTv/51LtpYbgPuXhN2sHY:OLcDx+72/51+cuXhN2Z
MD5:	5E3252E0248B484E76FCDBF8B42A645D
SHA1:	11AE92FD16AC87F6AB755911E85E263253C16516
SHA-256:	01F464FBB9B0BFD0E16D4AD6C5DE80F7AAD0F126E084D7F41FEF36BE6EC2FC8E
SHA-512:	540D6B3CA9C01E3E09673601514AF701A41E7D024070DE1257249C3C077AC53852BD04AB4AC928A38C9C84F423A6A3A89AB0676501A9EDC28F95DE83818FB699
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..../............"...0.............2.... ........@.. .......................@......<.....`.....................................O.......(...............0(... ......0...8............................................ ............... ..H............text........ ...................... ..`.rsrc...(...........................@..@.reloc....... ......................@..B........................H........0..d.............................................................{'.....{(.....{)...r.(.....}'.....}(.....}).......0..Y........u........L.,G(+....{'....{'...o,...,/(-....{(....{(...o....,.(/....{)....{)...o0.........0..K....... bHQ. )UU.Z(+....{'...o1...X )UU.Z(-....{(...o2...X )UU.Z(/....{)...o3...X..0...........r...p......%..{'......%q.........-.&.+.......o4....%..{(......%q.........-.&.+.......o4....%..{)......%q.........-.&.+.......o4....(5.....{6...*:.

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe.config

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1459
Entropy (8bit):	5.033662307409642
Encrypted:	false
SSDEEP:	24:2dErdGPF7Nv+13vH2/nVhOXrRH2/d9XF7N0PH2/+w39XF7NQ7uH2/F9y:cErU7h+1/gn27Rgdz7Eg+w3z76agFw
MD5:	C6ECF24757926EBA64E674BFF8B747D1
SHA1:	3A46083826C20E8E085C42BBFDFEEF4F9E2B90D9
SHA-256:	C3EC04142C15B0A237E72CE1C3C85D19CD1231B9824F7A9854E7909A74B7BECC
SHA-512:	EFABB9883ADB098A90115E8938C92B76BBB8D2EB5DE170ECFA205EE949A2D722E0F97F6E01F9A71AC8B5FA2108B9FF82FA0171759D50E30D0AB5FC1948BDCE15
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.ApplicationInsights" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.9.1.0" newVersion="2.9.1.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Buffers" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.3.0

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.584962500721156
Encrypted:	false
SSDEEP:	3:WhWQn:WZn
MD5:	5796D1F96BB31A9D07F4DB8AE9F0DDB3
SHA1:	93012724E6CC0A298838AEDE678806E6C0C6517D
SHA-256:	A90D255CCE3B419641FA0B9BA74D4DA464E0CE70638A9C2EBA03D6B34FCA1DC4
SHA-512:	890112DDCB3B92B739C0DD06721EFA81926CE3AAB04C55CDADB8C4E6B7A28C9796F08F508249DB189547DC4755804AA80CC8B104DD65C813A0450AAD2CDDA21C
Malicious:	false
Preview:	version=37.8

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackage.Common.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	102448
Entropy (8bit):	6.190879178656762
Encrypted:	false
SSDEEP:	1536:gPAt6+FT+ZGodV5iYbYSWd85e+ZS5sSak42QhLks2OL87Hxm:g2bYbYSWd85I5sSakFQhHL8g
MD5:	A86884A9A1C75604B2114E09B738FCF9
SHA1:	A82B444BF09CFCAE36F532C4EB4B8C5EF0933F6A
SHA-256:	EEF751E3B01C4071A1BA34E96B663E93631C51485AF31055C3EB2F75866F9FEC
SHA-512:	4B97A3D4C37129440816D0524CDB1C485AE68B6C6735857C157D7EA76ADD91241B7185C831C646713CFB4DFB3EC95E577F98088D08ACBB0313837CA584474299
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5f.........." ..0..^...........}... ........... ....................................`.................................`}..O.......8............h..0(..........(\|............................................... ............... ..H............text....]... ...^.................. ..`.rsrc...8............`..............@..@.reloc...............f..............@..B.................}......H........s..\|............................................................0..>.......~........o....~......(....&.s.......&...~....(....,..(....&.............$...........'........(............0..4.......(....o....r...p(....r...p(..........(....(......&..........00......:.(......}......0..Z............( ...,......(!...~..........("........( ...-..(....s#...........,..($.........(!.............&E.......0..G........{....,.(......5~%...r'..po&...rm..pr...po'...tR...r...p((..

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.CommonLib.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95280
Entropy (8bit):	5.997149012234495
Encrypted:	false
SSDEEP:	1536:S4aRSNSrXS5EaKoDMsUVl0HAWMco2bJkj87Hxsfn:S4auS7S5Ea6WMcpu8Mn
MD5:	0E5155ECBE5A1797644F1610DAA15583
SHA1:	89677E0F9443D52C73D4E0B91C5AEE5215EC4E88
SHA-256:	9BAF23C814DD100B2AC9511C9A2E5302DEE1FFB1807DEA021E1D317BA36901CA
SHA-512:	3F80A871547BDF47F0A5B58F54B9597D0894580FCEE8F53DD08C8A80658697FA9C9426AB8D47A40B0CDCF53D11769C654D26A3B530AD39A3A6E37D468CA309D3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.CommonLib.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=$..........." ..0..B..........b`... ........... ..............................d.....`..................................`..O.......4............L..0(..........h_..8............................................ ............... ..H............text...h@... ...B.................. ..`.rsrc...4............D..............@..@.reloc...............J..............@..B................A`......H.......Lh................................................................(......}......}.......}.......}........o<...}......{....>.{....o.......v.{....o...........s....(...+...0..<........{....o.....{....#.......@(....o.....{......o........&.............55........{....o.....{....#.......@(....o.....{......o......0..$........(......`...%..".o......{.....o....Z.(....r...po ...o......{....o/...r...p.(....(....o%...6..(....o......{......{.....s....z.s....z.s....z.s..

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.ModelsV3.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75312
Entropy (8bit):	6.240342116807372
Encrypted:	false
SSDEEP:	768:bu2lKxktXgl4icipJNz671/nVYWREDnAvk2jkbukZmyJsldySMcAn9fG1EcfgrYM:iF+qo7mDEwj4NXLGcfgruFcg7HxRM7
MD5:	F64746D633211D129AEC5DB988BCC9B1
SHA1:	78E7047265B0DF15C54FE84261D2A0B3568FEF31
SHA-256:	9EC285FDB857D5618FBD794464135BC56823B08146EA41F24FCEC3135F0E1C0B
SHA-512:	31BCE8F3DC415F562354044BA490A9252E6C20CAA38D5162AB3929111566BCA7E97D609EACAC4712E814AA8AACFCB7B32360E4F6EE5521D6223DCC4617A5614F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.ModelsV3.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6............" ..0.............F.... ... ....... .......................`............`.....................................O.... ..................0(...@..........T............................................ ............... ..H............text...L.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................%.......H.......t<..`.............................................................{...."..}......{...."..}......{...."..}......(......{...."..}......{...."..}......{...."..}......(.......0...........(.....(.....o....(.....0...........(.....(.....o....(...+..{...."..}......(......{...."..}......{...."..}......{...."..}......(......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......(......{...."..}......{...."..}....*..(..

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.Utils.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51760
Entropy (8bit):	6.408313907878965
Encrypted:	false
SSDEEP:	768:RQMnMYPWMXMwtKsSdj3xn91SPSvwzE8Kku6P3A+wf+bMEpYinAMxCk15:R9MYPJS/16/E8/3A+++bF7Hx315
MD5:	1CAB625AAF9CBCAB46B1455BCA45EF4C
SHA1:	274A3B9134AA4530110F29C1858A85D86D4A396D
SHA-256:	1CB4C57049F47E3EEFB1C2BAB2BA34A17ABDA610DC3D4D331A9B33B40B00307F
SHA-512:	BF4A53BFB9DCF13C87ED6E79640371908C73E7D67765B724C509B4EB7F3F66962F0883094640497CCD2FFCD255D1E46A50B33850E8B0B2D1CC684D40DE24F5D7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.Utils.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D............." ..0.............b.... ........... ....................................`.....................................O.......4...............0(..........$...T............................................ ............... ..H............text...h.... ...................... ..`.rsrc...4...........................@..@.reloc..............................@..B................B.......H.......\|E...q...........................................................0..........(.....o.....s........s............io........,...o.......jo....s....&.o.....O.........io ...&..i.X.O..........i(!.....i(".......(!....(#...................0.._........($....s.......(%........i.Yo.....O......jo......s&.......io ...&(........io'.......,..o...............FS........((...2.~....(........0...........()...,.r...ps...z.()...,.r...ps*...z.....~....s+....s,.......o-....[o....o/...

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Dapper.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	155184
Entropy (8bit):	6.247374284901675
Encrypted:	false
SSDEEP:	3072:A0feG0EI+t80zE04kjSnY2QJ6lwZaBsEFmWF+YkY:1P80zukOltwW9
MD5:	12572F87CCF0E40406B3554A1A6D3905
SHA1:	C9E238EF065D38400D084265EE056B2ABB694224
SHA-256:	6FDB589EBADF91A869EAA3A850B0FB17A8AB96BED78422E28F7EFAF63BC040F9
SHA-512:	D397888AACB1B787662B1678A24E24DDFA7A42C5363AC673706934A1A42E13F5ED55956D478FAF0998C77891A64F5F26E85DCFA7FFC0A6AE87DF26B3C24C4314
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%%.W.........." ..0..............M... ...`....... ....................................@.................................lM..O....`...............6..0(..........4L............................................... ............... ..H............text....-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............4..............@..B.................M......H.......d....G...........................................................0...........u....,..s.............Z.(....u-...%-.&o......{......{......{......{......{....2.(....._...2.(....._.....{....2.(....._......}......}......}.......}.......}.......}.......}....>.........}......{.......0...........o].....o^...(....%-.&+..o_....(....,...(....o`.....(....oa....(.......(b...,...(.......(c...od...+"(.......(b...,..(.......(c...od....(.......(e...,...(.......(f...og.

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\ICSharpCode.SharpZipLib.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	215088
Entropy (8bit):	6.030878409231256
Encrypted:	false
SSDEEP:	6144:x1uYsjrFIzmuxpOI/1MvCdRbpSISC8j7sA:YIzm6pOIgvr75
MD5:	44EBFB8CE52A4EFEDF07DA6875CA230E
SHA1:	824585DB12A35588F25C0CC5DA77EAEF94011CAD
SHA-256:	292F94823959CAFAAA77B81C0A490EA9ACF90B2553727BF3E74C1AE3A7F8AC01
SHA-512:	89DD6F5E827A9E23A8F7DBA8F89F55F2A01B290756AE7A6371A5934E9AFC6B3C5702DC0CADAB061405AEA4F2AC275902D8094E7A0ECDA29C8A438C6BCE46ABD0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............'... ...@....... ..............................`.....`..................................'..O....@..t............ ..0(...`.......&..T............................................ ............... ..H............text........ ...................... ..`.rsrc...t....@......................@..@.reloc.......`......................@..B.................'......H........... ...................$&........................................( ..."..(!...&...("...&...(#...2.r...p(...."..(....&...(....&...(....2.rE..p(...."..(....&...(....&...(....2.r...p(...."..(....&...(....&...(....J..r...p($...(....v....(%.....(%.....(%...(........L...%...%.r...p.%...%.r...p.%....%.r+..p.%...(&...(......(....&...(....&...(.....0..)........{.........('...t......\|......(...+...3.....0..)........{.........()...t......\|......(...+...3.

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Microsoft.ApplicationInsights.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	354352
Entropy (8bit):	6.153589479592355
Encrypted:	false
SSDEEP:	6144:Qr/iEF3zTxesPlx5zIAUH+2n8G4smIkuxhnCq7a/ZmvY2:Qhpp9xxIBeXGfvY2
MD5:	53594510735A737A2B25AF4B396EFE8F
SHA1:	3F4664E88F44BBDCA29AFFB78D866A76ED128965
SHA-256:	DFBBDBA40745B2FCDEC5973D1BB0352DD8618996A6231411C48D87D11C63D07A
SHA-512:	D9EBC5B83D8727E596EA6A72C49F58C5CB2BC02EC24B432709BCAA7C1C49E267F85520315EF644EC75DC24E3A5D49F64292A295822B27EDEFF452F552D8B89AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j.Y..........." ..0..8..........nW... ...`....... ....................................`..................................W..O....`...............@..0(..........HV..8............................................ ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............>..............@..B................OW......H.......`...ht...................U........................................{.....{+...V.(,.....}.....}+......0..;........u......,/(-....{....{...o....,.(/....{+....{+...o0..... S]G. )UU.Z(-....{...o1...X )UU.Z(/....{+...o2...X.0...........r...p......%..{....................-.q.............-.&.+.......o3....%..{+....................-.q.............-.&.+.......o3....(4.....{5.....{6.....{7.....{8.....(,.....}5.....}6.....}7......}8.......0..k........u......,_(-

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\NLog.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	883760
Entropy (8bit):	6.071511083932349
Encrypted:	false
SSDEEP:	24576:o1n1p9LdRN39aQLU0NnWSo7NReIGeFTiQaMcK2VJNUR10+xMhCJqtgsxUsQs:o1n1p9LdRN39aQZUq1
MD5:	286642CD396C5B6CADC906B112B493EE
SHA1:	CB625FDBD26798B3042BC5CFFD010F4E73CDAF1B
SHA-256:	004BF709595E808AE59558AE7510A40277B7E31D99A5580B0E07F136EAE09130
SHA-512:	49773E5AD432F893C559308DA144596CE1DFB967DB5FCFB1805528CC7535E70A181ED8801CAE43A47B58656C9925A236B06A4F2C67802A1A875A3DCE3C9002DD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..F..........:d... ........... ....................................`..................................c..O....................T..0(.......... c..T............................................ ............... ..H............text....D... ...F.................. ..`.rsrc................H..............@..@.reloc...............R..............@..B.................d......H........%...2...........W.......b......................................"..(......(...."..(......(......(......(.....(...."..(.......0..B.......~..........(b...~....,.~.....oc......+...(......od......,..(e............../7......"..(....6.(.....(......0..........(.......of...&..(....og...2(.....oc.......0..?.......~..........(b...~....,.~.....oc...+...(.....oh...&...,..(e....*.........,4.......0..?.......~..........(b...~....,.~....oi......+...(....oj......,..(e..

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Newtonsoft.Json.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	710192
Entropy (8bit):	5.960469418569573
Encrypted:	false
SSDEEP:	12288:2BARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTUD:2BA/ZTvQD0XY0AJBSjRlXP36RMG6
MD5:	B61A163EC8F1E6A3A3572A90BA23F7CB
SHA1:	467FBA9F1C171B58B76F4E9E24ABA1CE5C91D02F
SHA-256:	87DA900259BEA3BB65D984FB6FCD3134661E3EB0883EBF24981D50CA5D36F51A
SHA-512:	87EADB61D95EF67CEA0EC8CF15C2E285AFF8C92941ADB47DBCE6886796DE45B4940EFA803D2A9333FADD09473E1B1A34660042D12562FB07EAF4A59C401244CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D.}..........." ..0.................. ........... ....................... .......n....`.....................................O.......................0(.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......d....9..................h.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\OpenHardwareMonitorLib.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	293424
Entropy (8bit):	6.121629065121692
Encrypted:	false
SSDEEP:	6144:admT7N9hXNx16L/kakZieD2C6gVkRYKn6nUa9K+yB:adc7N/WkQHr64B
MD5:	3362FDB62A7980CA70C44B4DBDA5BE9B
SHA1:	77B328FD868E9BE19165C39B541E815BAD1FE13F
SHA-256:	A6B74A797384F89B692F2E1027A3F73B4FAD2A97914208158869A33068132A1C
SHA-512:	D0441E5C747707434C02A64E8FF3A49EDF33CFF2C9D22F2C22E8BDFEBC30A3CDF79B2ED96B8ABD819ECD042876BAA77C32E119EBB05BA0ECAC73DFE2BF971E86
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:.d.........." ..0..H..........rb... ........... ..............................k.....`................................. b..O.......$............R..0(........................................................... ............... ..H............text....F... ...H.................. ..`.rsrc...$............J..............@..@.reloc...............P..............@..B................Tb......H.......\....V...........................................................0...........(......o......e...%.r...p.s....}......}......}.......}......{......e...%.r...p.s....o....r...po.... ....(.....\|....(....-.."....}......{......e...%.r!..p.s....o........(....(....o.....(......(....-...}......}......{......{......0..a........{......W..}.....{....,..{.....o.....{.....{......e...%.r!..p.s....o.....{.......(....(....o......{........0..Z........{......P..}.....{....,..{.....o

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Polly.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	277040
Entropy (8bit):	6.190725872261733
Encrypted:	false
SSDEEP:	3072:ISOIleacQlBh2YQMoIBhpq01TLvlj9b6gRZNsRYl5:XuQlBAMW0BvltxZ66
MD5:	66C97A4217593113658977F5AEFC18D8
SHA1:	A7E4FF9BDB3800C1E93A0D521B53E344A10699FF
SHA-256:	9AD65CC593BFC60815124C6377A8F3EA4F031BCA01C688FB543B50A2B6418764
SHA-512:	D2A474718A38AA0EA738200D7584A5C21552DC76428176026C5509AE606FEA534F4AEABEDF93D5BAE5735754D82B2D93E4CFB67BCFEA9A435147D7BB4B1F0722
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............'... ...@....... ..............................?a....@..................................&..O....@..L...............0(...`.......%..T............................................ ............... ..H............text........ ...................... ..`.rsrc...L....@......................@..@.reloc.......`......................@..B.................&......H.......L[......................`%......................................^.{....,.(:...z..}.....^.{....,.(:...z..}....."..(?..."..(@......0..,.......sp......}........q...s7...sj....{.....(.....0..-.......sr......}........s...s7....ss....{.....(........0..(.......st......}........u...s7.....{.....(.....0..'.......sv......}........w...s7...sj.....(....B...ss.....(..........(.....0..'.......sx......}........y...s7...sj.....(....F...ss......(........0..Z..........}....

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\StructureMap.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	284208
Entropy (8bit):	6.117308680869445
Encrypted:	false
SSDEEP:	6144:QZgOtIGgeCEwNN4uaNZLVJ8ViVvW18KHxmeWntxX4xHe:Ggo0WPVTXg+
MD5:	A6D30251ED124D7656F523A7DF177D09
SHA1:	48092D267E067C1967B5ACF1AEBD9A18F0B91515
SHA-256:	EC81827B885C0B109AAA3882469BB41D26871274B2E39D3B227FBD18858BF6A3
SHA-512:	466809068B5813AC5531D9E5C76BA080A3A15B0D1AFF2A7187149CD5366D990DFD07DF1D51EEB8FCC656ED5C2D1C099AC32E0416F219FC38B64BD1A2351EE502
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....7..........." ..0..$...........C... ...`....... ....................................`..................................B..O....`..D...............0(...........A..T............................................ ............... ..H............text....#... ...$.................. ..`.rsrc...D....`.......&..............@..@.reloc...............,..............@..B.................B......H.......X~..x.............................................................o...+..o...+..(....n.-..r...p.r...p(<...s=...z...(.....o>...-.r...p.r)..p(<....s?...z.0..9..........o@......+$..........(A....oB...(...+,...+...X....i2....(D.......0..n.......sE.....oF......+A.......(...+,/..oG....,.rc..p..oH....oI...(J...sK...z...oL.....X....i2..oM............oN......(D......0..E........oO....+..oP......oQ......8...,......o....-....,..o.........8......*...........'.......V.-.

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Buffers.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22064
Entropy (8bit):	6.677526036924594
Encrypted:	false
SSDEEP:	384:gy/fjFwUI/KQyVvKdDhG6ISDFWvYW8aoNyb8E9VF6IYinAM+oCOq9tH6:guhMaVmzDC67EpYinAMxCQ
MD5:	8F678B241B955CF86CF65136ADE90539
SHA1:	DFD92464B9C5D6822062721C7C3497CD30850CC4
SHA-256:	15F8EEDC717B18D1A43BB3295BE6787E0DF002C284A06A4B9198851BCCFEB7F2
SHA-512:	482E6E33F22D7DC68D075600E3C6131A0B563796E34BEBE6352BE8455BD4ECC72F7B682C3E203FEE9CED67C78B60A96B58037CA7499D4F0F86E0B33AB836F048
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..$...........C... ...`....... ....................................@.................................sC..O....`..@...............0(...........A..8............................................ ............... ..H............text....#... ...$.................. ..`.rsrc...@....`.......&..............@..@.reloc...............,..............@..B.................C......H........(.. ........... @..X...xA......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(...........%...(.....(....,.r...p......%...%...%...(...........%...%...(......0..A.......(....,!r...p......%...%...%...%...(...........%...%...%...(.....~....2r...p.(....B.....(...........(....R.....(...+%-.&(....^.....(.....(...+&~..

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Data.SQLite.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	409136
Entropy (8bit):	6.098204637389941
Encrypted:	false
SSDEEP:	12288:bPaYZ6henFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbc17:p6heZBJm333M89QA+
MD5:	5B3639406ABB5AD7F16A90124B708862
SHA1:	466DB9D6BC5F2A8EB205E5F3A7F2EC8C52809597
SHA-256:	83717328623F05F5987DC258332BCA21C1F2858B7CE6B834AF5DA687B0948847
SHA-512:	F10717408E0140C8DBEFCCE9501CF03B86CECD32F2B55770879C28E21D793E45BD8B7EEED52E56E3386000A7BEEF7F0BDD05EBEFF99A44D1056512F48063F71C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.c...........!.................+... ...@....... ....................................`.................................H+..S....@..p...............0(...`...................................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B.................+......H...........tM..........PM..J...P .......................................6K/.%.L....7.......2.x..`..P.k:k.......0\W.j...;..xX.~..HB..S@.$.m...)4..<S1...C.Y......#ku.k&..2<..i{..>....U...s.'{:.(......}......{....:.(......}......{....r.(......}......}......}......0..5........-..~.....o.....X...v....~.......o......o .........6..(....(...."..(.....0..T........~!...("...-..-.~#...../....+...X....($...-..-.~#.....v........(%...~.......o&...*Z.~....2..~.........

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Diagnostics.DiagnosticSource.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51760
Entropy (8bit):	6.234968936412768
Encrypted:	false
SSDEEP:	768:3zpj9H0/bvvmNAkkOMo/23e3vggrkrD9Bxjpm2yuIFLlHTUpa/hDXEpYinAMxCWu:3zpjF0/t043e3vggr83jMYa/hU7HxVu
MD5:	BDFEF14C7A661E237F27B79E4FE950F6
SHA1:	83F7DC1950211EBEC2B326D0778E6A46781CF892
SHA-256:	689AF98555A3D5A36FE8841AD39F9196F60A6A5400A8CF41E6E0997F47E675F1
SHA-512:	1E698E4E1E6108524F48B6ED7720E0EE239679546FB429F415A52875C8FA0D5C0B2D8C3EE6F523D1B7E875D1FACA83B6A0EB5B62C0DAED414BDCB36FE0D5C043
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0.................. ........... ..............................b&....@.................................X...O.......................0(.......... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........J...g..........p...0.............................................{!...:.(".....}!.....0..#........u......,.(#....{!....{!...o$....v ..yN )UU.Z(#....{!...o%...X....0..M........r...p......%..{!....................-.q.............-.&.+.......o&....('.....{(...:.(".....}(....0..#........u......,.(#....{(....{(...o$....v ..:. )UU.Z(#....{(...o%...X....0..M........r-..p......%..{(....................-.q.............-.&.+.......o&....('.....{).....{...*V.("...

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Memory.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	138288
Entropy (8bit):	6.179921646668756
Encrypted:	false
SSDEEP:	3072:YP3XFz0qjCIIMAxlUXsKovHO420kN1A6C8Ils:Yh0qjC5RMOHO420kN1X
MD5:	8DDC05CED2922285C9037C7D503A86AA
SHA1:	AD66BA39BE8639D86877B515A68EC3D7AD3E7753
SHA-256:	30D4499D9F96D1B081C5A8B5F9D9792900DE6767243CBEAD81F6244C33C799E0
SHA-512:	6B7E9AC11076C4FAEBF6F51610023BAF0F513DD0680CA2A07DA9AE5E6F6AC42EDBF8CA8F9ED210AC5F3C7D280E8ACBBDAFA4C6916ED2003B9D94693587EEF656
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0.................. ... ....... .......................`...........@.................................3...O.... ..0...............0(...@..........8............................................ ............... ..H............text...\.... ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B................g.......H........ ..............P.......8.........................................(&...>..}......}......{......{......{.....{....3..{.....{....('......0...........%.u....,..........(.....z.{....%-.&.+.o(....{....(X.....(....zN........o)...s....(....z.s+.....(....zF(L....(F...s,....(....z.(M...s,....(....z.s-....(....z.s......(....zN........o)...s/....(....zrr...p(S....c.I...(F...s0....(....zBr...p(P...s0....(....z.s1....(....z.(O...s2....(!...z.(V...s2....(#...z

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Runtime.CompilerServices.Unsafe.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17968
Entropy (8bit):	6.676696708568243
Encrypted:	false
SSDEEP:	384:Th06sbbVVPWU2W+Nyb8E9VF6IYinAM+oCeBVmh:Ty9eEpYinAMxCAy
MD5:	2D491883E24603B382FDAD8840272070
SHA1:	78C442E11EA0B9ED3BBD09B19E6A18CC559CA58E
SHA-256:	EDF076BA91F6F5A808879D94A586D1BF78D5D0C8FDCD5399DE36FB6389301886
SHA-512:	0790CA5BB187AEFE4E5785C528C68E55EA4AFD642101A77A1D983599BC42AB4423723E910A0265CD9A5D3C7DFE0C9E9794DD6F6E8228B488A384647643C09C79
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._...........!.................3... ...@....@.. ...............................w....@.................................@3..K....@..................0(...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p3......H........$..0...................P ......................................._.%c......=.n')...(v..:}.d...3...B...).. .:Q(....L.jt....}Xv.b7y0r.[..$.....q..c.6.....p..2..qHv/.pb.=..9.o"z.. 0P.t%H....U...0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..............0..................0..................0..............

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27184
Entropy (8bit):	6.332801634669375
Encrypted:	false
SSDEEP:	768:kn1VM0JrpNWDcIh6leOiDFIFBYp1+/EpYinAMxCr/:knvXYcIh6yFIFBYpc47Hxk
MD5:	B62DB814A8E1C5C8F4DE32F142D7709F
SHA1:	DB5998A9C785E77A1152145615213EA31E06B289
SHA-256:	F3E5DDD22B8F044C9B45D99762F2A339077790AB049C1AAB152F70BC7127466E
SHA-512:	0F7DAE5AA68ED86A574F70478F99458C4A52B1913D232B20A58045EB1E49C83B9134DD90335FBCBEDEECF691EECE5A137FE06FF9F2F6B9D0607FACEA2C0D7C5B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ub.X.........." ..0..8...........W... ...`....... .............................../....@.................................dW..O....`...............B..0(..........,V............................................... ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................W......H.......4%..p/...........T.......U......................................r~....-.(....s.........~.......0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(...........%...(.....(....,.r...p......%...%...%...(...........%...%...(......0..A.......(....,!r...p......%...%...%...%...(...........%...%...%...(....2r...p.(..........(....2(.....(....^~....-.(.........~....*..0..........~..........(

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.ValueTuple.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	73264
Entropy (8bit):	5.955263962444665
Encrypted:	false
SSDEEP:	1536:6784YWac+abptsy5VyYc/9n1RcGxzeeUVn9KyQgHo0JuresehaAR7HxRq6L:67N1r9KGI04CCARLq6L
MD5:	F0A06E07C21B485434202D325B3AA058
SHA1:	6E4A0A572E3CA5A5B23D4633CE63300E3BB39658
SHA-256:	955FD5B1B046AFC9E62E2D0CA4698818FE1357EA764977D7A9B4A44C1F657169
SHA-512:	B398A6A66F184193CFA635D6B5DBA9ADB391782F2A82F4609ECB161A4340DC41C82F22A98FEB69F594B7DDF9FB677711BE1FBFA4D796146550E92D22DCA14D15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`............@.....................................O.... ..P...............0(...@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H.......$...h...........................................................6..o.........f..o...........o............o...........o...........o............o...........o ..........o!...........o"...........o#..........o$..........o%...........o&...........o'............0..L.........o(..........o)..........o...........o+...........o,...........o-.........0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... .......0..k.........o5....

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 12, cookie 0xb, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.4318983730538776
Encrypted:	false
SSDEEP:	24:TL0Gieiu5aZKpfmaw8FhGWLtDJufS5NGndNG58OMWoDFXB89356FQdXN+xZdNe39:TcFu5C4OZUlFJNGdNGveXXQXN+5NG1Z
MD5:	B4A865268D5ACA5F93BAB91D7D83C800
SHA1:	95AC9334096F5A38CA1C92DF31B1E73AE4586930
SHA-256:	5CBF60B0873660B151CF8CD62E326FE8006D1D0CBDE2FAD697E7F8AD3F284203
SHA-512:	C46EE29861F7E2A1E350CF32602B4369991510804B4B87985465090DD7AF64CF6D8DBFA2300F73B2F90F6AF95FC0CB5FD1E444B5DDB41DBC89746F04DCA6137B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c..............Z...?.j...I.:..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db-journal

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	2.957056177926657
Encrypted:	false
SSDEEP:	48:7MwqYGcZC4OZUlFJNGdNGveXXQXN+5NG1Zf:750SC4OoNSN1eN+5Nmf
MD5:	E7F473BD7223A820F15FAE36C76AF511
SHA1:	1CEA48439F19115159C250FE03A52246594D5E25
SHA-256:	31E8558B603B335EC6347D2837A57B23730331D5587F6763F36C13509BA49F18
SHA-512:	DA1BBC3710C4125323F9B7406452B8281AA76D814953D203467F261FFF754B4B027C52D5B4E4D3E1527D1AB1BBC8759886C3FA28E8700ADD31F682E40C1C9BC1
Malicious:	false
Preview:	.... .c.....*{.?....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................c..............Z...?.j...I.:......................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\x64\SQLite.Interop.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1799216
Entropy (8bit):	6.520454988999628
Encrypted:	false
SSDEEP:	24576:GuvfmOhyS2RuhV0yGzcuHpRs8ulCfUk+qKuMhUwqPevJ8QNYfjmqBBLbNFEohFY9:RHmUMohVWpu8ul0UkTgNCfyo3G
MD5:	CBA9D50085EE939B987CF758C727DD62
SHA1:	DDC0FAF68995883AC754662C59C4295BB0A64E3B
SHA-256:	75E47A697A46E31811FAB8C5D9FE1ABA6BA095B6D13DC79A8C848BE308917C37
SHA-512:	A5F3D1B96535E0B523ECD71DC36FD3AF157C630874FF11DA29066C545114D256B14A5EE2BA725679C4192182D37DF6900AA69ECE228BAFCE909A482DFF43A1E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............g...g...g.>.....g.>...B.g.>.....g.3.....g......g...f.^.g../....g......g......g......g.Rich..g.................PE..d.....c.........." .................n...............................................s....`.........................................`t.......e..x....`.......@..`....L..0(...p.........8...........................@...p...............`............................text...$........................... ..`.rdata..............................@..@.data...0........z..................@....pdata..`....@......................@..@.rsrc........`......................@..@.reloc...,...p......................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\x86\SQLite.Interop.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1475632
Entropy (8bit):	6.791868709546672
Encrypted:	false
SSDEEP:	24576:TS3uuk58wXpQous2GCzbHwGTzsIDQAKub0MBsIFBm5fi/5ATA9NTTPjXWJD8qC:6dwXpQdNVNDQubXyi60jXTW98qC
MD5:	3B462EFAACFAEBA904109B4FD3FE641F
SHA1:	6DB8785E94FDC2152895396CB9B3D3945DA5D25A
SHA-256:	1F9F620D4D7D32670073C335A2DC88A5A5DCFA7A5FF18E914EC6CD8EA983105F
SHA-512:	7295B1F7E4437729DFDAED5310EB26B5F4A8B96A2B97ADA8F8466712A69946BAADB2588071B51D661F4FD2A6029A2914E3DB73914BD2FE1C74D725F204063EF2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?.rG^.!G^.!G^.!.._!d^.!..]!.^.!..^!.^.!.))!O^.!Y..!D^.!G^.!.^.!d.B!F^.!!.Z!F^.!!.Y!F^.!!.\!F^.!RichG^.!................PE..L...r.c...........!.........*.......:.......@............................................@.........................0B..:....5..x....................\..0(.........pB..8............................1..@............@..0............................text...p-.......................... ..`.rdata..j....@.......2..............@..@.data...tt...`...T...N..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	Zip archive data, at least v4.5 to extract, compression method=deflate
Category:	dropped
Size (bytes):	342316
Entropy (8bit):	7.999331258360695
Encrypted:	true
SSDEEP:	6144:Ir6VUI82xfkgpWrvL/JVW2L3ukK29GSya5GZ7F2vtVygTNBr6VEZGqTkxU4sAQgY:Ir6+jAfk/rD/J3Lun8EaekVcgTzr6GZR
MD5:	09447F135F7F4486C165061CF443C569
SHA1:	3AD4264DB3112F845D35C112AABEA9CBB2E21AFA
SHA-256:	0142E2CA4F93C9631591065DC53944A86E4B961620F4FAF1FE8B61A8B2867C9B
SHA-512:	BE678FB5CA389198A5CC474C8E9E9D0C79A92A582CB81325B13D8BE226725AD04FAA6ECC3B4B7CECAEDAA6F15EC13F01C0276100EE19FAAF0A1B1DD7D061F31B
Malicious:	false
Preview:	PK..-.....#D.Y.V.:........-...AgentPackageSTRemote/AgentPackageSTRemote.exe....(........m......~.;8w.8...N.....]..z..1.o.?.............b...T.......W......v....,.3.<~.@.U...F]....oCo..a..dR......Q.+.Q+.#B..7.\.@.>o.;..J7wd........H...m.G/.^Y..2..u.._.b.0.%T.U....,^........W.....MS.+...;..N..63d..m.0w._`V.J.t..g.x....?f=...81}j.SS......z..M. ......=Y].yD.<..S..,.{..x&@g.&.}...A...y..<z`.Z.a.>H.......wo.k..]9.9..-.YvL..FhQ..P]..1.+~d.....'9...4O?.$h.....2.`..G....2T<..(.t..q.W#..]C.6/a...o....Q......c...X.....]q..U.%.....8...~..k....~.b...c3ob(G.&.S..8g.x.vO.Cz.yk.p5....i..-=.p...=^...wg.....N...R...TL..... ..uP...Q...... ..5....u..Ydn...RW..w.;).n.v.......WA.Q.........2....,Z....T..P..."....[h......~}..N.k...].6..M..\|.......To.......'..Q...&.y.........v...OK8.e^..%>.e..B1:7.#..(..........;...79\|.....n..u.,..[....#Q..........{...T...i..H....1.8.....S..\|__....^Cu...*....M..T....r..._G,....H....T=..?3.X..{.5..".0(6...\V...p!..1..S...d

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	72744
Entropy (8bit):	5.510938920637226
Encrypted:	false
SSDEEP:	1536:r8V3tfciq9s2k7Xvpci+yLYCJoUu7Q6P+O76q:klPna02B86P+ON
MD5:	67FEF41237025021CD4F792E8C24E95A
SHA1:	C47A5A33F182C8244798819E2DC5A908D51703E8
SHA-256:	C936879FBB1AA6D51FE1CDC0E351F933F835C0BF0E30AEF99A4E19A07A920029
SHA-512:	232015FE6BEE6637D915648A256474FC3DF79415AC90BABDFC2E3DED06C2F36FCE85573EC7670F2A05126AA5F24A570B36885E386061666D9EAA1F0DA67A093E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B.Pg.........."...0.................. ... ....@.. .......................`............`.....................................O.... ..P...............((...@....................................................... ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H........B...............................................................0..........(....9....(....~<...%-.&~;.....t...s....%.<...(...+~=...%-.&~;.....u...s....%.=...(...+~>...%-.&~;.....v...s....%.>...(...+~?...%-.&~;.....w...s....%.?...(...+...(.......0..-.......(.....3..r...pr...p(....,.(......(....+..._....0..(........(......~....(....,....(....~....(.....0.......... ....(......i./................&.........4...%.. ..o.......r9..p( ...,.*......s!.....s!............

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	541
Entropy (8bit):	5.097123194334321
Encrypted:	false
SSDEEP:	12:MMHdGp2VvOF9LNFF7ap+5v5OXrRf/2//FicYo4xT:JdsIOvPF7NhOXrRH2/d9y
MD5:	D0EFB0A6D260DBE5D8C91D94B77D7ACD
SHA1:	E33A8C642D2A4B3AF77E0C79671EAB5200A45613
SHA-256:	7D38534766A52326A04972A47CACA9C05E95169725D59AB4A995F8A498678102
SHA-512:	A3F1CFF570201B8944780CF475B58969332C6AF9BEA0A6231E59443B05FC96DF06A005FF05F78954DBE2FEC42DA207F6D26025AA558D0A30A36F0DF23A44A35C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>...<startup>....<supportedRuntime version="v4.0" />....<supportedRuntime version="v2.0.50727" />...</startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.584962500721156
Encrypted:	false
SSDEEP:	3:WhXRLW:WBRi
MD5:	B22628235C1F44AE054091C8FDC82D23
SHA1:	70C8E5ABD9D2D8A18B769F6E71819FB53B273B9B
SHA-256:	B31673E38897D5D84558E2745D02C553649A50063A9F0E7DE7E71BBA89916232
SHA-512:	C1097690938F3EDCBA20802DFB77880FB29D1F8B70C62FA76D1828613D57355FD04C0B3D26DA90128DB2DF2E63E4E30C8E195B84452C0931B8CB2F043D5BBA98
Malicious:	false
Preview:	version=24.3

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Atera.AgentPackage.Common.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	96808
Entropy (8bit):	6.179705686579105
Encrypted:	false
SSDEEP:	1536:FJt7dqUlizL21LDdeOKTfLz2L506wFj/XxFoKjhJG/50vks00UfgfgvO1762s:FQUm2H5KTfOLgxFJjE50vksVUfPvO1m
MD5:	C548EA0CD65F5981C2DF82A0177A9D3A
SHA1:	5D082BC6BC2D1F2267AE8525F3A528A0B58C3161
SHA-256:	BEAFAA0CF51CE914B58482094044A6CC742C3269431A812D5683CA3034ACCD84
SHA-512:	530AE2069185897612E0129135065954379F75F6C9F9DAEE3F7D9DFE49C7CEAFC8807DC866591F39337410FAFA76733705C316912F3A12AE85565ECB775476F4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.d.........." ..0..H..........zf... ........... ..............................;.....`.................................(f..O.......8............R..((...........d............................................... ............... ..H............text....F... ...H.................. ..`.rsrc...8............J..............@..@.reloc...............P..............@..B................\f......H........k..D............................................................0..>.......~........o....~......(....&.s.......&...~....(....,..(....&.............$...........'........(............0..4.......(....o....r...p(....r...p(..........(....(......&..........00......:.(......}......0..Z............( ...,......(!...~..........("........( ...-..(....s#...........,..($.........(!...*..........&E.......0..G........{....,.(......5~%...r'..po&...rm..pr...po'...tR...r...p((..

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Newtonsoft.Json.dll

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	710184
Entropy (8bit):	5.960555604702895
Encrypted:	false
SSDEEP:	12288:UBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTU4:UBjk38WuBcAbwoA/BkjSHXP36RMGN
MD5:	1792F462B4908235FBA6B3B4B2203276
SHA1:	E1B0CF8559C330377E2DE7FEE9FCC0FC3D34566A
SHA-256:	8CA1C3651A6F118C80E712BCB9C44031EB3D8C7180A60EDA5F2B24A0584082A9
SHA-512:	7AB9E256A4359A5560BD8C10014591F350F2788F72693234C16AA0B75F95F9EE3CF5E219B97A33944A5E730202BD355064885FD060812EE150107FFC84C92F65
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O.......................((.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\attendance-updated-time.txt

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.016875695766564
Encrypted:	false
SSDEEP:	3:WFSLoe:Wo9
MD5:	D0A757FA56D07F3DFD516911499ADBC2
SHA1:	5D592287F0B2D8D68B39F8686A7BD730BF6A0C0E
SHA-256:	89A18F5486CF408A403C45717ED7543426C763454475E467A88CCAD57D05AF54
SHA-512:	BA8096F24BFD46590B9FF640361E8A74CAF5543525DF55B07218D34CE1D0306695B782AB07CAE7A6D043DCE8F3CE14226750411552973EA41D7959E7999D18F8
Malicious:	false
Preview:	638695773991310489

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\log.txt

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	5.064435661629352
Encrypted:	false
SSDEEP:	24:sPQ0/bqd+sVNPusiQ0/bqd+sVNPuPQ0/bqd+sVNPuhEK:XUbgd5xUbgd5rUbgd5c9
MD5:	8E74C74675FAC65A2A6E902C6F3F6167
SHA1:	3FE45A12EBAF33A08EB0F806691796F518AB7127
SHA-256:	8B7D317116B4EB8B3F5C54D6990849F83B7F084F8263D0252998915039ECAEED
SHA-512:	AC8BC4AEE1495156E58B885483F806CA4768F9CD331CA1C4CBC225F1403A4B1C2024D7C2829E239EE4862796FEC7C4971AE70926AB794B022AC6DD6530FDC402
Malicious:	false
Preview:	..12/12/2024 05:16:39 Failed to set key: RequestPermissionOption with value: ..Exception: System.ArgumentNullException: Value cannot be null...Parameter name: value.. at System.ThrowHelper.ThrowArgumentNullException(ExceptionArgument argument).. at Microsoft.Win32.RegistryKey.SetValue(String name, Object value, RegistryValueKind valueKind).. at AgentPackageSTRemote.Persistence.AteraSettings.WindowsAteraSplashtopRegistry.SetValue(String key, Object value, SettingKeyType settingKeyType)..12/12/2024 05:16:39 Failed to set key: RequirePasswordOption with value: ..Exception: System.ArgumentNullException: Value cannot be null...Parameter name: value.. at System.ThrowHelper.ThrowArgumentNullException(ExceptionArgument argument).. at Microsoft.Win32.RegistryKey.SetValue(String name, Object value, RegistryValueKind valueKind).. at AgentPackageSTRemote.Persistence.AteraSettings.WindowsAteraSplashtopRegistry.SetValue(String key, Object value, SettingKeyType settingKeyType)..12/12/2024

C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	602672
Entropy (8bit):	6.145404526272746
Encrypted:	false
SSDEEP:	6144:UShQrHBJEwJiIJJ8TihsEWdzs29glRleqn4uRTJgwhVHhoNw0r17K7DDaiC3KM+9:gHDxJGihsEKwSuTuwvOWgFA
MD5:	17D74C03B6BCBCD88B46FCC58FC79A0D
SHA1:	BC0316E11C119806907C058D62513EB8CE32288C
SHA-256:	13774CC16C1254752EA801538BFB9A9D1328F8B4DD3FF41760AC492A245FBB15
SHA-512:	F1457A8596A4D4F9B98A7DCB79F79885FA28BD7FC09A606AD3CD6F37D732EC7E334A64458E51E65D839DDFCDF20B8B5676267AA8CED0080E8CF81A1B2291F030
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X............." ..0............." ... ...@....... ....................................`.....................................O....@..\|...............0(...`..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc...\|....@......................@..@.reloc.......`......................@..B................. ......H............{..................x.......................................r.(......}......}......}........0..,........-..{.....o...+.+..{.....{....s.....o...+..V.(......}......}....*...0...................-..+..o....s"........o$......o,....,..o....,...,....o(........,...oH...,...o......+.......9......o....,..{......o....o....o......s..........o&...8.....{......o....o........9e.....o.....?X.....r...po....9G.....r...po....o....r...p.( ...9&.....r...po....9......r...po....o.....

C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	73264
Entropy (8bit):	5.954475034553661
Encrypted:	false
SSDEEP:	1536:6784YWac+abptsy5VyYc/9n1RcGxzeeUVn9KyQgHo0JuresehaAR7HxRq:67N1r9KGI04CCARLq
MD5:	F4D9D65581BD82AF6108CFA3DD265A9A
SHA1:	A926695B1E5D3842D8345C56C087E58845307A16
SHA-256:	A3219CD30420EBCF7507C9C9F92FD551AE19999BE247CAA861A8A22D265BE379
SHA-512:	144C1195A440907592B22FC947F4284CA36869BDAE495EC8CA5212AF4F63E8E8492FB0EC3B37BF66DB912AF30864C69588D0E35ED9B3D24D36DF3B09DDB5B6C3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`.......f....@.....................................O.... ..P...............0(...@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H.......$...h...........................................................6..o.........f..o...........o............o...........o...........o............o...........o ..........o!...........o"...........o#..........o$..........o%...........o&...........o'............0..L.........o(..........o)..........o...........o+...........o,...........o-.........0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... .......0..k.........o5....

C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	5.1415141890473555
Encrypted:	false
SSDEEP:	6:AIipq9hX9w3pKFSQppwkCAQt1kUIU09DEMMRRDX:9ipch6MSQppwkAkUYEMQRX
MD5:	1BA76A4E1006A57EC5548433CD7A50C6
SHA1:	73EE514C65BC1AC7A23F2C361B0169FB874961EC
SHA-256:	B8CC5C95D0CBFE105F3A0422A1B5270F59191F7792329D88CFEA43FED630AC35
SHA-512:	FF9E4A2D9210E2C0AB0FBA366A37FB9340848EDAC61A26F6D4910BBA5DD7BAECF7A26777D4669B47A1E83F7FE51F1DE08419C5F23DB5BBFFDCA36913B2F902C6
Malicious:	false
Preview:	/i /IntegratorLogin=contato@opticaperformance.com.br /CompanyId=1 /IntegratorLoginUI= /CompanyIdUI= /FolderId= /AccountId=001Q300000OJqMsIAL /AgentId=14216fa6-dc15-4519-acf9-f0e1b34954b6.12/12/2024 05:15:13 Trace Starting..12/12/2024 05:16:34 Trace Starting..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AteraAgent.exe.log

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2402
Entropy (8bit):	5.362731083469072
Encrypted:	false
SSDEEP:	48:MxHKQg8mHDp684IHTQ06YHKGSI6oPtHTHhAHKKk+HKlT4v1qHGIs0HKaHKmTHlH7:iqzCIzQ06YqGSI6oPtzHeqKk+qZ4vwme
MD5:	28B4BFE9130A35038BD57B2F89847BAE
SHA1:	8DBF9D2800AB08CCA18B4BA00549513282B774A9
SHA-256:	19F498CAE589207075B8C82D7DACEAE23997D61B93A971A4F049DC14C8A3D514
SHA-512:	02100FD4059C4D32FBAAA9CEAACB14C50A4359E4217203B2F7A40E298AD819ED5469F2442291F12852527A2B7109CC5F7BFF7FDAD53BA5ABF75FC5F0474E984F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\e2ca4e2ddffdc0d0bda3f2ca65249790\System.ServiceProcess.ni.dll",0..3,"System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\434f871c532673e1359654ad68a1c225\System.Configuration.Install.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	651
Entropy (8bit):	5.343677015075984
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhaOK9eDLI4MNJK9P/JNTK9yiv:ML9E4KlKDE4KhKiKhPKIE4oKNzKoM
MD5:	7EEF860682F76EC7D541A8C1A3494E3D
SHA1:	58D759A845D2D961A5430E429EF777E60C48C87E
SHA-256:	65E958955AC5DBB7D7AD573EB4BB36BFF4A1DC52DD16CF79A5F7A0FA347727F1
SHA-512:	BF7767D55F624B8404240953A726AA616D0CE60EC1B3027710B919D6838EFF7281A79B49B22AB8B065D8CA921EF4D09017A0991CB4A21DAF09B3B43E6698CB04
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..

C:\Windows\Installer\5323c0.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AteraAgent, Author: Atera networks, Keywords: Installer, Comments: This installer database contains the logic and data required to install AteraAgent., Template: Intel;1033, Revision Number: {721AD955-79FD-4019-BBF5-9DCC4C1175BB}, Create Time/Date: Wed Feb 28 10:52:02 2024, Last Saved Time/Date: Wed Feb 28 10:52:02 2024, Number of Pages: 200, Number of Words: 6, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	2994176
Entropy (8bit):	7.878674703733536
Encrypted:	false
SSDEEP:	49152:6+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:6+lUlz9FKbsodq0YaH7ZPxMb8tT
MD5:	7BA4B194CE0469587C99E7B6B9EAE46E
SHA1:	A858D6167B1D1C446D6C176E016B38651D569580
SHA-256:	DA46033B88EA09024D4DFB1E604F57B1ECBDDFA630414190742E7A6E9E8D4FF3
SHA-512:	C54DC5E7A01C1491D05983CBC94DC50EC17CB7D14C5EC76D46DF681F637F76403F7FC10D9644952D8819153BD56D91BE628286F5D2DE0A4B00C26D7EFA173963
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\5323c2.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AteraAgent, Author: Atera networks, Keywords: Installer, Comments: This installer database contains the logic and data required to install AteraAgent., Template: Intel;1033, Revision Number: {721AD955-79FD-4019-BBF5-9DCC4C1175BB}, Create Time/Date: Wed Feb 28 10:52:02 2024, Last Saved Time/Date: Wed Feb 28 10:52:02 2024, Number of Pages: 200, Number of Words: 6, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	2994176
Entropy (8bit):	7.878674703733536
Encrypted:	false
SSDEEP:	49152:6+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:6+lUlz9FKbsodq0YaH7ZPxMb8tT
MD5:	7BA4B194CE0469587C99E7B6B9EAE46E
SHA1:	A858D6167B1D1C446D6C176E016B38651D569580
SHA-256:	DA46033B88EA09024D4DFB1E604F57B1ECBDDFA630414190742E7A6E9E8D4FF3
SHA-512:	C54DC5E7A01C1491D05983CBC94DC50EC17CB7D14C5EC76D46DF681F637F76403F7FC10D9644952D8819153BD56D91BE628286F5D2DE0A4B00C26D7EFA173963
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI25B4.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
Category:	dropped
Size (bytes):	521954
Entropy (8bit):	7.356225107100806
Encrypted:	false
SSDEEP:	12288:GnBaimP+DJLxQb6CBCldjCaOIM7PmD8WoKO2qHxf:kG2D3QbCldj1MK/tzG
MD5:	88D29734F37BDCFFD202EAFCDD082F9D
SHA1:	823B40D05A1CAB06B857ED87451BF683FDD56A5E
SHA-256:	87C97269E2B68898BE87B884CD6A21880E6F15336B1194713E12A2DB45F1DCCF
SHA-512:	1343ED80DCCF0FA4E7AE837B68926619D734BC52785B586A4F4102D205497D2715F951D9ACACC8C3E5434A94837820493173040DC90FB7339A34B6F3EF0288D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................'P\....'P^....'P_...........................>.......4..................R......:...........Rich...........................PE..L....o.]...........!.....D...\|.......L.......`......................................S#....@.........................0}...*......x.......d.......................4... s..T...........................xs..@............`..l............................text....B.......D.................. ..`.rdata...Q...`...R...H..............@..@.data...p...........................@....rsrc...d...........................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI25B4.tmp-\AlphaControlAgentInstallation.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.009968638752024
Encrypted:	false
SSDEEP:	384:akuS4rIWmFo967HkYc/4CmvZqVZa9VSlkfO2IROklJhwaHr1LpvTVi:RuVs3bXCmvZqu3u9OiNL1LpvTs
MD5:	AA1B9C5C685173FAD2DABEBEB3171F01
SHA1:	ED756B1760E563CE888276FF248C734B7DD851FB
SHA-256:	E44A6582CD3F84F4255D3C230E0A2C284E0CFFA0CA5E62E4D749E089555494C7
SHA-512:	D3BFB4BD7E7FDB7159FBFC14056067C813CE52CDD91E885BDAAC36820B5385FB70077BF58EC434D31A5A48245EB62B6794794618C73FE7953F79A4FC26592334
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Installer\MSI25B4.tmp-\AlphaControlAgentInstallation.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R..e.........." ..0..Z..........Bx... ........... ....................................`..................................w..O....................................v............................................... ............... ..H............text...HX... ...Z.................. ..`.rsrc................\..............@..@.reloc...............b..............@..B................$x......H........5...A............................................................(....r...p(.....s....o....,.r;..p(....(.... ....r...p(.......0..M........(....r...p(.....s@...oA...,$(H...-..s'...r...pr;..p.o(.....o....r[..p(.........0..N........(....r...p(.....o....r...p..o....,..,..~.....o....,...s+...o,...r...p(.......(....r...p(.....s>...o?...rE..p(.......(....rm..p(.....s'...r...p..o(...r...p(.......(....r...p(.....s'...r...p..o(...r;..p(.......(....r]..p(.....s'...r...p

C:\Windows\Installer\MSI25B4.tmp-\CustomAction.config

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1538
Entropy (8bit):	4.735670966653348
Encrypted:	false
SSDEEP:	24:2dhmhx0PY6Iee7LfKhT06XWslTh17jJB+aZtG9jDqRp:c0nd5t7q7WsFD7t3tG96n
MD5:	BC17E956CDE8DD5425F2B2A68ED919F8
SHA1:	5E3736331E9E2F6BF851E3355F31006CCD8CAA99
SHA-256:	E4FF538599C2D8E898D7F90CCF74081192D5AFA8040E6B6C180F3AA0F46AD2C5
SHA-512:	02090DAF1D5226B33EDAAE80263431A7A5B35A2ECE97F74F494CC138002211E71498D42C260395ED40AEE8E4A40474B395690B8B24E4AEE19F0231DA7377A940
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies.. by using the latest

C:\Windows\Installer\MSI25B4.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	184240
Entropy (8bit):	5.876033362692288
Encrypted:	false
SSDEEP:	3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
MD5:	1A5CAEA6734FDD07CAA514C3F3FB75DA
SHA1:	F070AC0D91BD337D7952ABD1DDF19A737B94510C
SHA-256:	CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
SHA-512:	A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI25B4.tmp-\Newtonsoft.Json.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.96669864901384
Encrypted:	false
SSDEEP:	12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
MD5:	715A1FBEE4665E99E859EDA667FE8034
SHA1:	E13C6E4210043C4976DCDC447EA2B32854F70CC6
SHA-256:	C5C83BBC1741BE6FF4C490C0AEE34C162945423EC577C646538B2D21CE13199E
SHA-512:	BF9744CCB20F8205B2DE39DBE79D34497B4D5C19B353D0F95E87EA7EF7FA1784AEA87E10EFCEF11E4C90451EAA47A379204EB0533AA3018E378DD3511CE0E8AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D.}..........." ..0.................. ........... ....................... ............`.....................................O......................../.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......d....9..................h.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Windows\Installer\MSI25B4.tmp-\System.Management.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61448
Entropy (8bit):	6.332072334718381
Encrypted:	false
SSDEEP:	768:xieZDWtg+ESsRTgCayrMkp6SEI9016UJKdi1diF55U/h:xwg+ESsVgCayY/pYgwkd0Eh
MD5:	878E361C41C05C0519BFC72C7D6E141C
SHA1:	432EF61862D3C7A95AB42DF36A7CAF27D08DC98F
SHA-256:	24DE61B5CAB2E3495FE8D817FB6E80094662846F976CF38997987270F8BBAE40
SHA-512:	59A7CBB9224EE28A0F3D88E5F0C518B248768FF0013189C954A3012463E5C0BA63A7297497131C9C0306332646AF935DD3A1ACF0D3E4E449351C28EC9F1BE1FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....bP.........." ..................... .........c. ....................... ......>.....`.....................................O.......\................>........................................................... ............... ..H............text........ ...................... ..`.rsrc...\...........................@..@.reloc..............................@..B........................H........"..`...........D....".......................................................................................0...............0.......................................................................0...............................................................................................................................................0...............0...................................................0...............0..............................................

C:\Windows\Installer\MSI2CD9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
Category:	dropped
Size (bytes):	521954
Entropy (8bit):	7.356225107100806
Encrypted:	false
SSDEEP:	12288:GnBaimP+DJLxQb6CBCldjCaOIM7PmD8WoKO2qHxf:kG2D3QbCldj1MK/tzG
MD5:	88D29734F37BDCFFD202EAFCDD082F9D
SHA1:	823B40D05A1CAB06B857ED87451BF683FDD56A5E
SHA-256:	87C97269E2B68898BE87B884CD6A21880E6F15336B1194713E12A2DB45F1DCCF
SHA-512:	1343ED80DCCF0FA4E7AE837B68926619D734BC52785B586A4F4102D205497D2715F951D9ACACC8C3E5434A94837820493173040DC90FB7339A34B6F3EF0288D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................'P\....'P^....'P_...........................>.......4..................R......:...........Rich...........................PE..L....o.]...........!.....D...\|.......L.......`......................................S#....@.........................0}...*......x.......d.......................4... s..T...........................xs..@............`..l............................text....B.......D.................. ..`.rdata...Q...`...R...H..............@..@.data...p...........................@....rsrc...d...........................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2CD9.tmp-\AlphaControlAgentInstallation.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.009968638752024
Encrypted:	false
SSDEEP:	384:akuS4rIWmFo967HkYc/4CmvZqVZa9VSlkfO2IROklJhwaHr1LpvTVi:RuVs3bXCmvZqu3u9OiNL1LpvTs
MD5:	AA1B9C5C685173FAD2DABEBEB3171F01
SHA1:	ED756B1760E563CE888276FF248C734B7DD851FB
SHA-256:	E44A6582CD3F84F4255D3C230E0A2C284E0CFFA0CA5E62E4D749E089555494C7
SHA-512:	D3BFB4BD7E7FDB7159FBFC14056067C813CE52CDD91E885BDAAC36820B5385FB70077BF58EC434D31A5A48245EB62B6794794618C73FE7953F79A4FC26592334
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Installer\MSI2CD9.tmp-\AlphaControlAgentInstallation.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R..e.........." ..0..Z..........Bx... ........... ....................................`..................................w..O....................................v............................................... ............... ..H............text...HX... ...Z.................. ..`.rsrc................\..............@..@.reloc...............b..............@..B................$x......H........5...A............................................................(....r...p(.....s....o....,.r;..p(....(.... ....r...p(.......0..M........(....r...p(.....s@...oA...,$(H...-..s'...r...pr;..p.o(.....o....r[..p(.........0..N........(....r...p(.....o....r...p..o....,..,..~.....o....,...s+...o,...r...p(.......(....r...p(.....s>...o?...rE..p(.......(....rm..p(.....s'...r...p..o(...r...p(.......(....r...p(.....s'...r...p..o(...r;..p(.......(....r]..p(.....s'...r...p

C:\Windows\Installer\MSI2CD9.tmp-\CustomAction.config

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1538
Entropy (8bit):	4.735670966653348
Encrypted:	false
SSDEEP:	24:2dhmhx0PY6Iee7LfKhT06XWslTh17jJB+aZtG9jDqRp:c0nd5t7q7WsFD7t3tG96n
MD5:	BC17E956CDE8DD5425F2B2A68ED919F8
SHA1:	5E3736331E9E2F6BF851E3355F31006CCD8CAA99
SHA-256:	E4FF538599C2D8E898D7F90CCF74081192D5AFA8040E6B6C180F3AA0F46AD2C5
SHA-512:	02090DAF1D5226B33EDAAE80263431A7A5B35A2ECE97F74F494CC138002211E71498D42C260395ED40AEE8E4A40474B395690B8B24E4AEE19F0231DA7377A940
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies.. by using the latest

C:\Windows\Installer\MSI2CD9.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	184240
Entropy (8bit):	5.876033362692288
Encrypted:	false
SSDEEP:	3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
MD5:	1A5CAEA6734FDD07CAA514C3F3FB75DA
SHA1:	F070AC0D91BD337D7952ABD1DDF19A737B94510C
SHA-256:	CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
SHA-512:	A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2CD9.tmp-\Newtonsoft.Json.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.96669864901384
Encrypted:	false
SSDEEP:	12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
MD5:	715A1FBEE4665E99E859EDA667FE8034
SHA1:	E13C6E4210043C4976DCDC447EA2B32854F70CC6
SHA-256:	C5C83BBC1741BE6FF4C490C0AEE34C162945423EC577C646538B2D21CE13199E
SHA-512:	BF9744CCB20F8205B2DE39DBE79D34497B4D5C19B353D0F95E87EA7EF7FA1784AEA87E10EFCEF11E4C90451EAA47A379204EB0533AA3018E378DD3511CE0E8AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D.}..........." ..0.................. ........... ....................... ............`.....................................O......................../.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......d....9..................h.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Windows\Installer\MSI2CD9.tmp-\System.Management.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61448
Entropy (8bit):	6.332072334718381
Encrypted:	false
SSDEEP:	768:xieZDWtg+ESsRTgCayrMkp6SEI9016UJKdi1diF55U/h:xwg+ESsVgCayY/pYgwkd0Eh
MD5:	878E361C41C05C0519BFC72C7D6E141C
SHA1:	432EF61862D3C7A95AB42DF36A7CAF27D08DC98F
SHA-256:	24DE61B5CAB2E3495FE8D817FB6E80094662846F976CF38997987270F8BBAE40
SHA-512:	59A7CBB9224EE28A0F3D88E5F0C518B248768FF0013189C954A3012463E5C0BA63A7297497131C9C0306332646AF935DD3A1ACF0D3E4E449351C28EC9F1BE1FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....bP.........." ..................... .........c. ....................... ......>.....`.....................................O.......\................>........................................................... ............... ..H............text........ ...................... ..`.rsrc...\...........................@..@.reloc..............................@..B........................H........"..`...........D....".......................................................................................0...............0.......................................................................0...............................................................................................................................................0...............0...................................................0...............0..............................................

C:\Windows\Installer\MSI438F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
Category:	dropped
Size (bytes):	521954
Entropy (8bit):	7.356225107100806
Encrypted:	false
SSDEEP:	12288:GnBaimP+DJLxQb6CBCldjCaOIM7PmD8WoKO2qHxf:kG2D3QbCldj1MK/tzG
MD5:	88D29734F37BDCFFD202EAFCDD082F9D
SHA1:	823B40D05A1CAB06B857ED87451BF683FDD56A5E
SHA-256:	87C97269E2B68898BE87B884CD6A21880E6F15336B1194713E12A2DB45F1DCCF
SHA-512:	1343ED80DCCF0FA4E7AE837B68926619D734BC52785B586A4F4102D205497D2715F951D9ACACC8C3E5434A94837820493173040DC90FB7339A34B6F3EF0288D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................'P\....'P^....'P_...........................>.......4..................R......:...........Rich...........................PE..L....o.]...........!.....D...\|.......L.......`......................................S#....@.........................0}...*......x.......d.......................4... s..T...........................xs..@............`..l............................text....B.......D.................. ..`.rdata...Q...`...R...H..............@..@.data...p...........................@....rsrc...d...........................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI438F.tmp-\AlphaControlAgentInstallation.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.009968638752024
Encrypted:	false
SSDEEP:	384:akuS4rIWmFo967HkYc/4CmvZqVZa9VSlkfO2IROklJhwaHr1LpvTVi:RuVs3bXCmvZqu3u9OiNL1LpvTs
MD5:	AA1B9C5C685173FAD2DABEBEB3171F01
SHA1:	ED756B1760E563CE888276FF248C734B7DD851FB
SHA-256:	E44A6582CD3F84F4255D3C230E0A2C284E0CFFA0CA5E62E4D749E089555494C7
SHA-512:	D3BFB4BD7E7FDB7159FBFC14056067C813CE52CDD91E885BDAAC36820B5385FB70077BF58EC434D31A5A48245EB62B6794794618C73FE7953F79A4FC26592334
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Installer\MSI438F.tmp-\AlphaControlAgentInstallation.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R..e.........." ..0..Z..........Bx... ........... ....................................`..................................w..O....................................v............................................... ............... ..H............text...HX... ...Z.................. ..`.rsrc................\..............@..@.reloc...............b..............@..B................$x......H........5...A............................................................(....r...p(.....s....o....,.r;..p(....(.... ....r...p(.......0..M........(....r...p(.....s@...oA...,$(H...-..s'...r...pr;..p.o(.....o....r[..p(.........0..N........(....r...p(.....o....r...p..o....,..,..~.....o....,...s+...o,...r...p(.......(....r...p(.....s>...o?...rE..p(.......(....rm..p(.....s'...r...p..o(...r...p(.......(....r...p(.....s'...r...p..o(...r;..p(.......(....r]..p(.....s'...r...p

C:\Windows\Installer\MSI438F.tmp-\CustomAction.config

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1538
Entropy (8bit):	4.735670966653348
Encrypted:	false
SSDEEP:	24:2dhmhx0PY6Iee7LfKhT06XWslTh17jJB+aZtG9jDqRp:c0nd5t7q7WsFD7t3tG96n
MD5:	BC17E956CDE8DD5425F2B2A68ED919F8
SHA1:	5E3736331E9E2F6BF851E3355F31006CCD8CAA99
SHA-256:	E4FF538599C2D8E898D7F90CCF74081192D5AFA8040E6B6C180F3AA0F46AD2C5
SHA-512:	02090DAF1D5226B33EDAAE80263431A7A5B35A2ECE97F74F494CC138002211E71498D42C260395ED40AEE8E4A40474B395690B8B24E4AEE19F0231DA7377A940
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies.. by using the latest

C:\Windows\Installer\MSI438F.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	184240
Entropy (8bit):	5.876033362692288
Encrypted:	false
SSDEEP:	3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
MD5:	1A5CAEA6734FDD07CAA514C3F3FB75DA
SHA1:	F070AC0D91BD337D7952ABD1DDF19A737B94510C
SHA-256:	CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
SHA-512:	A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI438F.tmp-\Newtonsoft.Json.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.96669864901384
Encrypted:	false
SSDEEP:	12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
MD5:	715A1FBEE4665E99E859EDA667FE8034
SHA1:	E13C6E4210043C4976DCDC447EA2B32854F70CC6
SHA-256:	C5C83BBC1741BE6FF4C490C0AEE34C162945423EC577C646538B2D21CE13199E
SHA-512:	BF9744CCB20F8205B2DE39DBE79D34497B4D5C19B353D0F95E87EA7EF7FA1784AEA87E10EFCEF11E4C90451EAA47A379204EB0533AA3018E378DD3511CE0E8AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D.}..........." ..0.................. ........... ....................... ............`.....................................O......................../.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......d....9..................h.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Windows\Installer\MSI438F.tmp-\System.Management.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61448
Entropy (8bit):	6.332072334718381
Encrypted:	false
SSDEEP:	768:xieZDWtg+ESsRTgCayrMkp6SEI9016UJKdi1diF55U/h:xwg+ESsVgCayY/pYgwkd0Eh
MD5:	878E361C41C05C0519BFC72C7D6E141C
SHA1:	432EF61862D3C7A95AB42DF36A7CAF27D08DC98F
SHA-256:	24DE61B5CAB2E3495FE8D817FB6E80094662846F976CF38997987270F8BBAE40
SHA-512:	59A7CBB9224EE28A0F3D88E5F0C518B248768FF0013189C954A3012463E5C0BA63A7297497131C9C0306332646AF935DD3A1ACF0D3E4E449351C28EC9F1BE1FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....bP.........." ..................... .........c. ....................... ......>.....`.....................................O.......\................>........................................................... ............... ..H............text........ ...................... ..`.rsrc...\...........................@..@.reloc..............................@..B........................H........"..`...........D....".......................................................................................0...............0.......................................................................0...............................................................................................................................................0...............0...................................................0...............0..............................................

C:\Windows\Installer\MSI4584.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	437321
Entropy (8bit):	6.648101151963609
Encrypted:	false
SSDEEP:	12288:St3jOZy2KsGU6a4Ksht3jOZy2KsGU6a4KsD:6zOE2Z34KGzOE2Z34K6
MD5:	EBC8BA57B1813546F880E34A8B0E9EDD
SHA1:	A5C494323E1B312E1CE217E3DDE343B465DA002E
SHA-256:	2BE70A5AD047F6EFE520293F5D883FF999DA226BBAA189B17118F1404CE7AA5C
SHA-512:	D306EEC285D93BCCC698A97F3608A196609D89A3219B3DFC07F40F222691019C10D7C3A4B6FCA9603CB5E1D75328D9E20442A1F85A6C91EAC82126CDA6D4B815
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Installer\MSI4584.tmp, Author: Joe Security
Preview:	...@IXOS.@.....@.).Y.@.....@.....@.....@.....@.....@......&.{E732A0D7-A2F2-4657-AC41-B19742648E45}..AteraAgent..RQ--029.msi.@.....@.....@.....@........&.{721AD955-79FD-4019-BBF5-9DCC4C1175BB}.....@.....@.....@.....@.......@.....@.....@.......@......AteraAgent......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........StopAteraServiceQuiet....J...StopAteraServiceQuiet.@A......M..MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........................^.......\......].........................,.......<.........L...'.....'.....'.P.......8.....'.....Rich............................PE..L...Ap.]...........!.........P............................................................@.........................@................P..x....................`..........T...............................@...............<............................text...[......................

C:\Windows\Installer\MSI4594.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	216496
Entropy (8bit):	6.646208142644182
Encrypted:	false
SSDEEP:	3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
MD5:	A3AE5D86ECF38DB9427359EA37A5F646
SHA1:	EB4CB5FF520717038ADADCC5E1EF8F7C24B27A90
SHA-256:	C8D190D5BE1EFD2D52F72A72AE9DFA3940AB3FACEB626405959349654FE18B74
SHA-512:	96ECB3BC00848EEB2836E289EF7B7B2607D30790FFD1AE0E0ACFC2E14F26A991C6E728B8DC67280426E478C70231F9E13F514E52C8CE7D956C1FAD0E322D98E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........................^.......\......].........................,.......<.........L...'.....'.....'.P.......8.....'.....Rich............................PE..L...Ap.]...........!.........P............................................................@.........................@................P..x....................`..........T...............................@...............<............................text...[........................... ..`.rdata..............................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4603.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	216496
Entropy (8bit):	6.646208142644182
Encrypted:	false
SSDEEP:	3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
MD5:	A3AE5D86ECF38DB9427359EA37A5F646
SHA1:	EB4CB5FF520717038ADADCC5E1EF8F7C24B27A90
SHA-256:	C8D190D5BE1EFD2D52F72A72AE9DFA3940AB3FACEB626405959349654FE18B74
SHA-512:	96ECB3BC00848EEB2836E289EF7B7B2607D30790FFD1AE0E0ACFC2E14F26A991C6E728B8DC67280426E478C70231F9E13F514E52C8CE7D956C1FAD0E322D98E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........................^.......\......].........................,.......<.........L...'.....'.....'.P.......8.....'.....Rich............................PE..L...Ap.]...........!.........P............................................................@.........................@................P..x....................`..........T...............................@...............<............................text...[........................... ..`.rdata..............................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI472D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	216496
Entropy (8bit):	6.646208142644182
Encrypted:	false
SSDEEP:	3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
MD5:	A3AE5D86ECF38DB9427359EA37A5F646
SHA1:	EB4CB5FF520717038ADADCC5E1EF8F7C24B27A90
SHA-256:	C8D190D5BE1EFD2D52F72A72AE9DFA3940AB3FACEB626405959349654FE18B74
SHA-512:	96ECB3BC00848EEB2836E289EF7B7B2607D30790FFD1AE0E0ACFC2E14F26A991C6E728B8DC67280426E478C70231F9E13F514E52C8CE7D956C1FAD0E322D98E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........................^.......\......].........................,.......<.........L...'.....'.....'.P.......8.....'.....Rich............................PE..L...Ap.]...........!.........P............................................................@.........................@................P..x....................`..........T...............................@...............<............................text...[........................... ..`.rdata..............................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI619B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
Category:	modified
Size (bytes):	521954
Entropy (8bit):	7.356225107100806
Encrypted:	false
SSDEEP:	12288:GnBaimP+DJLxQb6CBCldjCaOIM7PmD8WoKO2qHxf:kG2D3QbCldj1MK/tzG
MD5:	88D29734F37BDCFFD202EAFCDD082F9D
SHA1:	823B40D05A1CAB06B857ED87451BF683FDD56A5E
SHA-256:	87C97269E2B68898BE87B884CD6A21880E6F15336B1194713E12A2DB45F1DCCF
SHA-512:	1343ED80DCCF0FA4E7AE837B68926619D734BC52785B586A4F4102D205497D2715F951D9ACACC8C3E5434A94837820493173040DC90FB7339A34B6F3EF0288D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................'P\....'P^....'P_...........................>.......4..................R......:...........Rich...........................PE..L....o.]...........!.....D...\|.......L.......`......................................S#....@.........................0}...*......x.......d.......................4... s..T...........................xs..@............`..l............................text....B.......D.................. ..`.rdata...Q...`...R...H..............@..@.data...p...........................@....rsrc...d...........................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI619B.tmp-\AlphaControlAgentInstallation.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.009968638752024
Encrypted:	false
SSDEEP:	384:akuS4rIWmFo967HkYc/4CmvZqVZa9VSlkfO2IROklJhwaHr1LpvTVi:RuVs3bXCmvZqu3u9OiNL1LpvTs
MD5:	AA1B9C5C685173FAD2DABEBEB3171F01
SHA1:	ED756B1760E563CE888276FF248C734B7DD851FB
SHA-256:	E44A6582CD3F84F4255D3C230E0A2C284E0CFFA0CA5E62E4D749E089555494C7
SHA-512:	D3BFB4BD7E7FDB7159FBFC14056067C813CE52CDD91E885BDAAC36820B5385FB70077BF58EC434D31A5A48245EB62B6794794618C73FE7953F79A4FC26592334
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Installer\MSI619B.tmp-\AlphaControlAgentInstallation.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R..e.........." ..0..Z..........Bx... ........... ....................................`..................................w..O....................................v............................................... ............... ..H............text...HX... ...Z.................. ..`.rsrc................\..............@..@.reloc...............b..............@..B................$x......H........5...A............................................................(....r...p(.....s....o....,.r;..p(....(.... ....r...p(.......0..M........(....r...p(.....s@...oA...,$(H...-..s'...r...pr;..p.o(.....o....r[..p(.........0..N........(....r...p(.....o....r...p..o....,..,..~.....o....,...s+...o,...r...p(.......(....r...p(.....s>...o?...rE..p(.......(....rm..p(.....s'...r...p..o(...r...p(.......(....r...p(.....s'...r...p..o(...r;..p(.......(....r]..p(.....s'...r...p

C:\Windows\Installer\MSI619B.tmp-\CustomAction.config

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1538
Entropy (8bit):	4.735670966653348
Encrypted:	false
SSDEEP:	24:2dhmhx0PY6Iee7LfKhT06XWslTh17jJB+aZtG9jDqRp:c0nd5t7q7WsFD7t3tG96n
MD5:	BC17E956CDE8DD5425F2B2A68ED919F8
SHA1:	5E3736331E9E2F6BF851E3355F31006CCD8CAA99
SHA-256:	E4FF538599C2D8E898D7F90CCF74081192D5AFA8040E6B6C180F3AA0F46AD2C5
SHA-512:	02090DAF1D5226B33EDAAE80263431A7A5B35A2ECE97F74F494CC138002211E71498D42C260395ED40AEE8E4A40474B395690B8B24E4AEE19F0231DA7377A940
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies.. by using the latest

C:\Windows\Installer\MSI619B.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	184240
Entropy (8bit):	5.876033362692288
Encrypted:	false
SSDEEP:	3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
MD5:	1A5CAEA6734FDD07CAA514C3F3FB75DA
SHA1:	F070AC0D91BD337D7952ABD1DDF19A737B94510C
SHA-256:	CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
SHA-512:	A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI619B.tmp-\Newtonsoft.Json.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.96669864901384
Encrypted:	false
SSDEEP:	12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
MD5:	715A1FBEE4665E99E859EDA667FE8034
SHA1:	E13C6E4210043C4976DCDC447EA2B32854F70CC6
SHA-256:	C5C83BBC1741BE6FF4C490C0AEE34C162945423EC577C646538B2D21CE13199E
SHA-512:	BF9744CCB20F8205B2DE39DBE79D34497B4D5C19B353D0F95E87EA7EF7FA1784AEA87E10EFCEF11E4C90451EAA47A379204EB0533AA3018E378DD3511CE0E8AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D.}..........." ..0.................. ........... ....................... ............`.....................................O......................../.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......d....9..................h.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Windows\Installer\MSI619B.tmp-\System.Management.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61448
Entropy (8bit):	6.332072334718381
Encrypted:	false
SSDEEP:	768:xieZDWtg+ESsRTgCayrMkp6SEI9016UJKdi1diF55U/h:xwg+ESsVgCayY/pYgwkd0Eh
MD5:	878E361C41C05C0519BFC72C7D6E141C
SHA1:	432EF61862D3C7A95AB42DF36A7CAF27D08DC98F
SHA-256:	24DE61B5CAB2E3495FE8D817FB6E80094662846F976CF38997987270F8BBAE40
SHA-512:	59A7CBB9224EE28A0F3D88E5F0C518B248768FF0013189C954A3012463E5C0BA63A7297497131C9C0306332646AF935DD3A1ACF0D3E4E449351C28EC9F1BE1FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....bP.........." ..................... .........c. ....................... ......>.....`.....................................O.......\................>........................................................... ............... ..H............text........ ...................... ..`.rsrc...\...........................@..@.reloc..............................@..B........................H........"..`...........D....".......................................................................................0...............0.......................................................................0...............................................................................................................................................0...............0...................................................0...............0..............................................

C:\Windows\Installer\SourceHash{E732A0D7-A2F2-4657-AC41-B19742648E45}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.163873351227982
Encrypted:	false
SSDEEP:	12:JSbX72FjgPAGiLIlHVRpY5h/7777777777777777777777777vDHFp2bH4pdl0i5:J6QI5eibtF
MD5:	1B384F4C30B5B874AF9E0026DE9BE044
SHA1:	50D88F38E521A4795B74B962A88CDB2E48258B98
SHA-256:	5A164CBE5635B3197E18C4BB495B3E62F078BB7882A93E65902C975A53C06E71
SHA-512:	7330C2C27DBFFFCDD0A90FD1D4628806D8CDD59216035A6F7C3ECCB1D748A3E6953EA77D62236E5BEDD78B642765FA5C7012A827D55770D961F172084890B9FF
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.560528538853144
Encrypted:	false
SSDEEP:	48:08PhluRc06WXJeFT5P1UqISoedGPdGfoHprfStedGPdGRub1n:Lhl11FTTxItdox
MD5:	F7ECF42F4FF5BE4C945E776ECB97055B
SHA1:	1C5FDD2C88CD2F08605EB124AFF9ABB6223B8688
SHA-256:	4A8602C0C29832875B2817622F5EDCC222D374FBD49AC99BF7BF02C452ACA4BA
SHA-512:	80F3C55BFE6AA3B7D2AF1381A6C10066A4CA07DD1AE1CD286749B412DE8C4CE49C4B1A0AA5CEF488BBBA401BD39C1276CDA3BBBCE3DE18CE72461521DB180B76
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Installer\inprogressinstallinfo.ipi, Author: Joe Security
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.3751855983679695
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaub:zTtbmkExhMJCIpErG
MD5:	0BC7D2EEFC5F4C4F740551A494A10E23
SHA1:	A456968B18E07F20073D52C8860261CC36BE46A1
SHA-256:	B0DDAE3873C83F03FB7EB3702089D90E1019648219AD812391E3F7A5DA5BADB1
SHA-512:	D045B6BB1332278DE7A3D195E2F4A6CEA73A6F03FE30620B1FE6A591B68CF8280CBF3ED9975C1F532CD0F664FAA400D93847A71E64957A5EEA9AC82F14D01813
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\System32\InstallUtil.InstallLog

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	704
Entropy (8bit):	4.805280550692434
Encrypted:	false
SSDEEP:	12:tIDRFK4mAX7RBem7hccD+PRem7hUhiiGNGNdg6MhgRBem7hccD+PRem7hUGNGNkm:Us43XVBVhcmMRVhMipNVeBVhcmMRVhro
MD5:	EF51E16A5B81AB912F2478FE0A0379D6
SHA1:	B0F9E2EE284DD1590EA31B2D3AD736D77B9FC6A7
SHA-256:	2C5D5397CEDF66DB724FED7FB4515B026A894F517A0DFBE8AE8ADF52DB61AA22
SHA-512:	296A11DB55BFEE7D87897BB63BC9E2C05786D3FD73A894DA5AF76F7A756495C6CCC0959C88844DFB5560DE2374A257201D960E004EC09D8C9DFB50952C5EF2D2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\System32\InstallUtil.InstallLog, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\System32\InstallUtil.InstallLog, Author: Joe Security
Preview:	...Running a transacted installation.....Beginning the Install phase of the installation...See the contents of the log file for the C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe assembly's progress...The file is located at C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog.....The Install phase completed successfully, and the Commit phase is beginning...See the contents of the log file for the C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe assembly's progress...The file is located at C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog.....The Commit phase completed successfully.....The transacted install has completed...

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	112451
Entropy (8bit):	6.451881213221821
Encrypted:	false
SSDEEP:	1536:QnTuwoxd0xXtgF1Z3t0zfIagnbSLDIIfF61AAOkC7i:QTuVxd09SZ3+gbE8qF61UO
MD5:	FC98941039CF97C1A6A2C79324E2B39F
SHA1:	79DDA1313C998166E72F303C73A0BB37A8DFFBF0
SHA-256:	E53F2DE565A19781A05B552D52D96E415C2820C8D5FA90E84907298595D32D36
SHA-512:	C7032CD4C3D8FFE4841EA7922DFA003B5F4AE6D38408097E4ACDA64AE7A82B387A53159E07898A3FCBEC3936862C4C55D2EE0D46715788E4E3066DEDC72FB52A
Malicious:	false
Preview:	0...>0...%...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..241211125548Z..241218125548Z0...S0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\329B6147266C1E26CD774EA22B79EC2E

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	112451
Entropy (8bit):	6.451881213221821
Encrypted:	false
SSDEEP:	1536:QnTuwoxd0xXtgF1Z3t0zfIagnbSLDIIfF61AAOkC7i:QTuVxd09SZ3+gbE8qF61UO
MD5:	FC98941039CF97C1A6A2C79324E2B39F
SHA1:	79DDA1313C998166E72F303C73A0BB37A8DFFBF0
SHA-256:	E53F2DE565A19781A05B552D52D96E415C2820C8D5FA90E84907298595D32D36
SHA-512:	C7032CD4C3D8FFE4841EA7922DFA003B5F4AE6D38408097E4ACDA64AE7A82B387A53159E07898A3FCBEC3936862C4C55D2EE0D46715788E4E3066DEDC72FB52A
Malicious:	false
Preview:	0...>0...%...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..241211125548Z..241218125548Z0...S0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4761 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4761
Entropy (8bit):	7.945585251880973
Encrypted:	false
SSDEEP:	96:6ZUpZsm0HwZ8FLSeXs+aiL9qcZ7KtlAD1GlNHgdkVI5F11AcNmwkVFzGz6ENhZC7:62T0QOLl8vAqcZ7K3AUNAdx5FAx9VEOj
MD5:	77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA1:	9E98ACE72BD2AB931341427A856EF4CEA6FAF806
SHA-256:	5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
SHA-512:	3537DA5E7F3ABA3DAFE6A86E9511ABA20B7A3D34F30AEA6CC11FEEF7768BD63C0C85679C49E99C3291BD1B552DED2C6973B6C2F7F6D731BCFACECAB218E72FD4
Malicious:	false
Preview:	MSCF............,...................O..................YWP .disallowedcert.stl.lJ..B...CK.wTS.....{.&Uz.I."E".HS@. .P.!.....E. .DQ..... EDA.H. E..""/.s<.s.9.....&#.{~k.VV..7@......b.R....MdT..B.L..%.C......" ....%.4%..%.B..T.d...S.....pem..$....&.q.`.+...E..C.....$.\|.A.!~d.H>w%S$...QC't..;..<..R@....2. .l..?..c..A....Ew...l..K$.. ~...'......Mt^c..s.Y%..}......h......m....h.......~d...,...=ge3.....2%..(...T..!].....!C~.X..MHU.o[.z].Y...&lXG;uW.:...2!..][\/.G..]6#.I...S..#F.X.k.j.....)Nc.].t^.-l.Y...4?.b...rY....A......7.D.H\.R...s.L,.6.\|.....VQ....<........... [Z....].N0LU.X........6..C\....F.....KbZ..^=.@.B..MyH...%.2.>...]..E.....sZ.f..3z.].Y.t.d$.....P...,. .~..mNZ[PL.<....d..+...l.-...b.^....6F..z.&.;D.._..c."...d..... k9....60?&..Y.v.dgu...{.....{..d=..$......@^..qA..*uJ..@W.V..eC..AV.e+21...N.{.]..]..f]..`Z.....]2.....x..f..K...t. ...e.V.U.$PV..@6W\_nsm.n.........A<.......d....@f..Z... >R..k.....8..Y....E>..2o7..........c..K7n....

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	471
Entropy (8bit):	7.197541850876882
Encrypted:	false
SSDEEP:	12:JyYOqX5GLsHqm/pPzvqb+r9dw/vr4WOQAGs9+p:JROwILsXzvSm9ivr4Ac+p
MD5:	4A9AA6A614556E086A26FD3799E56DDD
SHA1:	F20B660DFABA446060F0C074A511CB931ADC1129
SHA-256:	1F26A246511A771E468F21EBF16EBC65771824106B0CDF4AC4D7686A0E33F9EC
SHA-512:	417FE3D13064B688BC432A363BB8FFCBB5236B0481EB804889FFE836F3796D5E96634F1685C4F36588C067A05CB15B50795BF6363F1DED5C23533FAECB15AD47
Malicious:	false
Preview:	0..........0.....+.....0......0...0......E....1-Q...!..m....20241211190516Z0s0q0I0...+...........@..D3=?..Mn8...Q..E....1-Q...!..m..........-...P..@.Z....20241211190516Z....20241218190516Z0...*.H.............a.&M....7..5..)~..ZhB...u.VTy~$u..#.'%i\|...JR....1.k......c..N?..........46.......r0.\.=p]...7...#.....0.?...-...\|3.n.c.....Dv..cBU.4.q.B..UR.S.q/..1..=..=.x.L....\p.W.J..$r.......b...m.=..w.......]..aO<lu..M....v.&.."l....T.......J/.....J:..$

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	727
Entropy (8bit):	7.574774567887195
Encrypted:	false
SSDEEP:	12:5o6Tq92X5h44TUqfqbtJ6y2GRpKX5SZhs6jF7uKJA/5UOQMaigNrmgos1QaT:5XoqK6ytpE5ih7jZuIA/5UNMaiZgXQaT
MD5:	F76EA8D407AEFF7D3B9B71FF12148127
SHA1:	FB765776DE94F0E47A760830437D2E1C7CD726ED
SHA-256:	2ACED6D341EC9FB1FCA196969D9E1016949DA2820433F21018813485081AD869
SHA-512:	8C7CD7EA6089CA3CC44982A8319B4EF58CA3230BF2885E6A07003D69C6B74084E906448E789E28DE44E13304D8F988094C5AB43B749F70BF3F2E7F7B6CE6521E
Malicious:	false
Preview:	0..........0.....+.....0......0...0......h7..;._....a{..e.NB..20241211213658Z0s0q0I0...+.........]....^Idk...NG.X....h7..;._....a{..e.NB...(I.x...#...R....20241211212102Z....20241218202102Z0...*.H.............P!.......!43..2.o..EJ.f.xw<..k..M.Y..q.....u.CP.;T.h..%. ..Te..mV........q6($.=.CB.=...w.k......JK.{...dA.-...........5......4..&X:..i...p+'..P..0%.t.raq....x.?.,...w..9."u...kg.nU...k....\uA].......nd..M..v.. .F...3..V..........y.:O.%.F+...7T..$.5..TD7.\~Z..qf..".2..!+..f`.'6.. ...".j.M......h.1Ar....W...!...\..)r.5..Y.......}.......K.%#a....&OQS...(..-{?aaC.\|...-I\.."....~..q......0......-2e.?..I.)........kA..gp.....f...GA.<k'.[.XLI?..e.F....AI.8.....:R.k.]/Xu..y...2.\|e...PJ...m.

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BA74182F76F15A9CF514DEF352303C95

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.57830664597755
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRv6EsFfBTIfnMYflafAP76T/HezUBf5JzHWEfOBHOpUtrtA:y2GWnSv6EstSPbla4PGT/HTlfPf6Oury
MD5:	101C4BC965FECACBF19883C27252AFEB
SHA1:	536D1AC0BF259647CBD6CCC7B1FCEBFEACF42B07
SHA-256:	E1704465DEEB264DA13DC363A1B880A9FA009251A17EED32D6D11845A85D3AEC
SHA-512:	4D93FD89767250C56FF2C07DC583E79456B58A24CF9A423E34D2BC4D77F9E670A804FF123956AE34573ACDB11D6C94AFA0DA29F64DACC92FE7BDDE7202BAF7B4
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..241210210859Z..241231210859Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............}...($.4.,+V]...._lZ.V...EXp......7.....b:..z...RVh'..$nFR;r.D...j.....!d#.21.H.U.w^>..^...........=9.Q..xn0L.t.P...~2.'.O..O3...j.d.}.?.. ..v.-..3m?...-....r4..Z...P@.?....9.u\.@hV..!.....%<..i#...A...t........M6....i.U.(......yN............[M.Q.../r..$..F..A..G\.i.1.q..A.j{I#.tr.#T?<.)-y.HR..).\............H.......L..;yh%.t~..rT..vg.....j8-.{..e[i..].R......4.....4m1......R!.f..X...+.u.R..C..1g.....].......q......:..P..,\|....nQ..dx.7.1.W..\|.&^._3>.....-...;K.Nz (]..b.7'p.....~...V

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.596259519827648
Encrypted:	false
SSDEEP:	48:GL3d+gG48zmf8grQcPJ27AcYG7i47V28Tl4JZG0FWk8ZHJ:GTd0PmfrrQG28cYG28CEJ
MD5:	D91299E84355CD8D5A86795A0118B6E9
SHA1:	7B0F360B775F76C94A12CA48445AA2D2A875701C
SHA-256:	46011EDE1C147EB2BC731A539B7C047B7EE93E48B9D3C3BA710CE132BBDFAC6B
SHA-512:	6D11D03F2DF2D931FAC9F47CEDA70D81D51A9116C1EF362D67B7874F91BF20915006F7AF8ECEBAEA59D2DC144536B25EA091CC33C04C9A3808EEFDC69C90E816
Malicious:	false
Preview:	0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&%....\...L.b.^3........+..6y.....u.e..HP.w....P.F.aX..\|..<.(.9....S..G.u0..0.v..[K]taM?..v.X.r.)A...m&vh.A.X..&+..MY.x.J>@G_.Ps..#!Y`.dT..!..8.\|f..x8E0.O.cOL....SA\|X=G....2...l<.V.........Y0..U0...U.......0.......0...U......h7..;._....a{..e.NB0...U.#..0.......q]dL..g?....O0...U...........0...U.%..0...+.......0w..+........k0i0$..+.....0...http:/

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	727
Entropy (8bit):	7.573234338584923
Encrypted:	false
SSDEEP:	12:5onfZIc5RlRtBfQe4j/s/7m8KzWNHdASf8SHq5Vw1M8ohCOsTCI9VbGx947kzJnK:5iScdZV4j/QKzeHd8Z5Z8cNsTC6Vb4Dg
MD5:	144166BCDD73DE6BC88826B56A505CF7
SHA1:	EC02BF36EE81DA1C0B9092337A054956480EA26A
SHA-256:	D7ED6D87057832F9A9D0476CC4F287CFD161453D978088BAC3504428709A7523
SHA-512:	F56BBC0ED83C96AAC239356E0664AC511B7C4C651017843F9FADF189E9A5DC0BC9F0EBA3CB95179383D69C076FEB966C2FD9BF00EF976E2C925AE8CBADA4E463
Malicious:	false
Preview:	0..........0.....+.....0......0...0..........q]dL..g?....O..20241211184215Z0s0q0I0...+........."..;F..=\@ua..........q]dL..g?....O....@.`.L.^........20241211184215Z....20241218184215Z0....H.............Z.%..p.@.;..B...U3^f.p..Ao.,#G..D."^n...C'.q=....60Km@......<Ym....\7......u..J.. .......;Ik.\7r.."..;}.z.w.%...x.L.....h......c.7.b...-7.j.+D..=&.q.h9.7r$.....{...1....._...[.L]nT..w..............`..........#..L%.?....P....5].i......O/5X....mv..[.umf..nt=.-.!h.Z..&M...) (.g.:S.....h.9R.*.8).1.@....bN.g1...<...`j.i.r.+.AqoP...j>....t.$.0..5..)..p].4....p.kD..I!...\..'s..V......z.V.....=.2.......%.m.N.6a...X.6.J.W..]:....AL..C..+,..[..3.u.0.._.q.g.20f........G....~..5..\[....]..;.k_oP.z^!...t...

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.688784034406474
Encrypted:	false
SSDEEP:	24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
MD5:	78F2FCAA601F2FB4EBC937BA532E7549
SHA1:	DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
SHA-256:	552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
SHA-512:	BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
Malicious:	false
Preview:	0...0..x..........W..!2.9...wu\0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0....H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...sn..\|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..\|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0....H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.288554598350884
Encrypted:	false
SSDEEP:	6:kK/3K/QXx4+AUSW0P3PeXJUwh8lmi36lQKILRs/:3qQBNxSW0P3PeXJUZ6KO
MD5:	E57BBEC94E2BF98D0564323D682F48A9
SHA1:	070811127CC2EF64095611ADF9BDADAF3B5E0509
SHA-256:	BC1E4828E9C0F80BB1F4B2D20792ADB4AF7AD5408F6A6A2A3D47F53DB2BC469B
SHA-512:	299901E8E13EBBBFD507B779D57CC6960F125613F58E44DEB590A98750BCD7610F7E544C3DFE8A05B51E5A91168B46CC6E1F508DDA8F472ACB5F298C2A4F486F
Malicious:	false
Preview:	p...... ........YL.W....(....................................................... ........,..K.. ..."...........C...h.t.t.p.:././.c.r.l.3...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.G.4.C.o.d.e.S.i.g.n.i.n.g.R.S.A.4.0.9.6.S.H.A.3.8.4.2.0.2.1.C.A.1...c.r.l...".6.7.5.9.9.0.5.d.-.1.b.7.4.3."...

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	modified
Size (bytes):	306
Entropy (8bit):	3.285761287983978
Encrypted:	false
SSDEEP:	6:kK1Xx44OAUSW0P3PeXJUwh8lmi36lQKILRs/:tBoxSW0P3PeXJUZ6KO
MD5:	803355C8F66FEA3AE204CF3FC891CD4D
SHA1:	7FCA685EEC5BDCB41AD5D05E5C9726EED8727E0E
SHA-256:	E2A860CC3B47FF901BAF1AA50AA964790B6AA4A0233F1D28F0D4A1E3068DCADA
SHA-512:	730125A25C9678FA8AE02CF55319638B05ED792DDB7FE289687B466C0EBAF81FDB40284F0FB267E27BE0A3C3BD44BBBA7478E49908FA50BEC8A5748D1BE1A1D6
Malicious:	false
Preview:	p...... ........>...z...(....................................................... ........,..K.. ..."...........C...h.t.t.p.:././.c.r.l.4...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.G.4.C.o.d.e.S.i.g.n.i.n.g.R.S.A.4.0.9.6.S.H.A.3.8.4.2.0.2.1.C.A.1...c.r.l...".6.7.5.9.9.0.5.d.-.1.b.7.4.3."...

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	340
Entropy (8bit):	3.5448660063018527
Encrypted:	false
SSDEEP:	6:kKYq8XkfEG7DNfUN+SkQlPlEGYRMY9z+s3Ql2DUeXJlOW1:xxLkPlE99SCQl2DUeXJlOA
MD5:	0F3A8CFFB257474BCC0C74E14883FAE6
SHA1:	95003A640D7587ABA8EEA3085E427A8574A108BF
SHA-256:	371FD1ABBA56BF2196342CC308D32EE8707184514B57C4CD880944FAAE2C99BB
SHA-512:	8727FE23102E3EF97E5944E81D1D1E1861CB06DA7069D5F95EE66175E2D3EAF5B9C01C5E385471F07E6336E7F04969AD61C8989C21C2228F591975144CF1A935
Malicious:	false
Preview:	p...... .........9...^..(....................................................M.. ........~..MG......&.....6.........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".0.6.c.f.c.c.5.4.d.4.7.d.b.1.:.0."...

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	3.954864952539273
Encrypted:	false
SSDEEP:	6:kKi5tkzlLs6XlRNfOAUMivhClroFzCJCgO3lwuqDnlyQ4hY5isIlQhZgJn:qstpmxMiv8sFzD3quqDkPh8Y2ZM
MD5:	0A9AEF8539A2E8A2C4093A294133D59D
SHA1:	7F10311BCCBFEEE0DDE50D77C373B61D0DC00D8D
SHA-256:	8EB317B525FF91C60C550D133637AC3E66920068E87D486E4773EAECCA272839
SHA-512:	54EA0F3E79765A8EE9B851914CAF9E9526405149445D1C8FF27DE92EC3564EC9A87DFA005CFAE3D259D0C94E5542A14C1B0BD77A20E715D56936FDC6133F5F41
Malicious:	false
Preview:	p...... ............~L..(....................K...>...Q...................>...Q.. .........F.rL.. ...................h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.3.x.L.4.L.Q.L.X.D.R.D.M.9.P.6.6.5.T.W.4.4.2.v.r.s.U.Q.Q.U.R.e.u.i.r.%.2.F.S.S.y.4.I.x.L.V.G.L.p.6.c.h.n.f.N.t.y.A.8.C.E.A.6.b.G.I.7.5.0.C.3.n.7.9.t.Q.4.g.h.A.G.F.o.%.3.D...

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	404
Entropy (8bit):	3.690873643601798
Encrypted:	false
SSDEEP:	6:kK397bV/s4sllQfOAUMivhClroFHXHDZA6liyZlSlMul0bg3PWovy28lhl+KscSd:l9/Ns4mxMiv8sF3HtllJZIvOP205scn8
MD5:	F7B9925383B5AD891C9F5436F83D73E2
SHA1:	9271F7E266538CB03D81FF32E8730F86B6DB41A6
SHA-256:	B6EEA246F2D74C06F9486EC293AD1D821B0ECB9027ED9441B1DC27FD75774019
SHA-512:	AC2BCB944BE7F28FCE926222CC6A010D1840FE19816A69BAA0A34D3CC1D4409B72ADA2CCE9D7CBB1DD3C434044FAC9190A6CA82646AE4263267B9A0E2AA3B783
Malicious:	false
Preview:	p...... .... ......p....(..................................................[.Q.. ........._wzL.. ...................h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.S.R.X.e.r.F.0.e.F.e.S.W.R.r.i.p.T.g.T.k.c.J.W.M.m.7.i.Q.Q.U.a.D.f.g.6.7.Y.7.%.2.B.F.8.R.h.v.v.%.2.B.Y.X.s.I.i.G.X.0.T.k.I.C.E.A.o.o.S.Z.l.4.5.Y.m.N.9.A.o.j.j.r.i.l.U.u.g.%.3.D...

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	248
Entropy (8bit):	3.7893766751508964
Encrypted:	false
SSDEEP:	3:kkFkl3kNnXXN/k51/ll3llwC/kll/hHbFvtINRR8WXdA31y+NW0y1YbXKw+l1M79:kKCPtl//sTFmFAUSW0PTKDXM6lQyls
MD5:	9F74165FAE5D87FE4A8FC379A5851073
SHA1:	3AB90A60D7A0C2695E1E7B41998A8970C37C0658
SHA-256:	AEA634D63BDDDF6FC106710866F342895E95FEC248783E8698C970602C296EED
SHA-512:	A1E4EA6F8E4882375C56CBE51297D963E274590E31F70FE8B95430DE185C21B53C297002599C363F890F9C6115FBA5FC22388482B4855228693DFEAB8E85804A
Malicious:	false
Preview:	p...... ....f.......~..(................'..GK....5.[....................5.[.. ...........PK.. ...................h.t.t.p.:././.c.r.l.3...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.l...".6.7.5.8.b.d.6.e.-.2.e.1."...

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	308
Entropy (8bit):	3.202608361208122
Encrypted:	false
SSDEEP:	6:kKRlfzNcalgRAOAUSW0P3PeXJUwh8lmi3Y:GtWOxSW0P3PeXJUZY
MD5:	74DFFB04129DF8633217357A36697E4E
SHA1:	CA529DB399D453C6CF49C759A58DFC754D7714D3
SHA-256:	56624FDF1E822294992DE0000D6F4568F75BEE6DC3AD35E7087D758B99A08E79
SHA-512:	569C1297A9F75FCB6AC98EFB78A42F4BD0E52C4FDADB3B455DDD3E829802516405C563040210372873D92026E000AF6090E940984E7D3C807F6DC71564740389
Malicious:	false
Preview:	p...... ........C"...L..(....................................................... ........}.-@@......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.G.4.C.o.d.e.S.i.g.n.i.n.g.R.S.A.4.0.9.6.S.H.A.3.8.4.2.0.2.1.C.A.1...c.r.t...".6.0.9.0.3.0.2.2.-.6.b.4."...

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	412
Entropy (8bit):	3.51067602799373
Encrypted:	false
SSDEEP:	6:kKCsbfOAUMivhClroFfJSUm2SQwItJqB3UgPSgakZdPolRMnOlAkrn:LbmxMiv8sFBSfamB3rbFURMOlAkr
MD5:	F6262BF9F4380651E90625F7290F2FD6
SHA1:	19A73DE9C31A855A65660DFB768C26072634268B
SHA-256:	DC402C3CDB41C76D17D0D7E62F9BF2741711F0A4102B2F7A64829C7EFF926AD2
SHA-512:	E010FA603C4B1592A43FD2841A2E1AD69C0C90E3B8D4E7F8AC1D611125F77FC014754EE1792EDB2498F84FBA5C5E47130204993DF69A068D02619E060B0B5ADE
Malicious:	false
Preview:	p...... ....(...hk.}.r..(....................................................... ........v.vrL.. ...................h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.f.I.s.%.2.B.L.j.D.t.G.w.Q.0.9.X.E.B.1.Y.e.q.%.2.B.t.X.%.2.B.B.g.Q.Q.U.7.N.f.j.g.t.J.x.X.W.R.M.3.y.5.n.P.%.2.B.e.6.m.K.4.c.D.0.8.C.E.A.i.t.Q.L.J.g.0.p.x.M.n.1.7.N.q.b.2.T.r.t.k.%.3.D...

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.037150835475167
Encrypted:	false
SSDEEP:	6:kKJPhLDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:xPhLYS4tWOxSW0PAMsZp
MD5:	FD17854472BB0A427A2F52F3A939B8E5
SHA1:	CF7793118826FEDE3B2C8CA434B81F8D9291020B
SHA-256:	D62AE277A40F3283E827131D02E269438213DD3503EF5DB0B5AD9A6D64A04413
SHA-512:	B8DA3F604DF247E8FC5A9DE7E2281A093730919E661B44DDD0D70963B2495ACE9C9E087B36DAA93D0331BFF1BA1B749AF9EEE77F8527C84674EC6FEAFC01DD18
Malicious:	false
Preview:	p...... ....l....lh-.M..(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageAgentInformation.exe.log

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1944
Entropy (8bit):	5.343420056309075
Encrypted:	false
SSDEEP:	48:MxHKQg8mHDp684YHKGSI6oPtHTHhAHKKkhHNpaHKlT44HKmHKe60:iqzCYqGSI6oPtzHeqKkhtpaqZ44qmq10
MD5:	437E4DCFC04CB727093C5232EA15F856
SHA1:	81B949390201F3B70AE2375518A0FFD329310837
SHA-256:	5EADB9774A50B6AD20D588FDA58F5A42B2E257A0AA26832B41F8EA008C1EB96B
SHA-512:	0332C7E5205CF9221172473A841284487ACC111780A58557231FCDE72A5EDB7E7E3EF6C87AB9682A688BC24992A74027F930267B541039BD8757EEF4E2F51A0E
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\e2ca4e2ddffdc0d0bda3f2ca65249790\System.ServiceProcess.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.

C:\Windows\Temp\SplashtopStreamer.exe

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	11738238
Entropy (8bit):	7.675419536971462
Encrypted:	false
SSDEEP:	196608:CUk11u3HYB+LKDCRMhs6YNlXpOlttuaQrC9vQ3H2u6VEUr6/RmI:sBHCRMhdYN1pOlttpvQ3WuOlr6/cI
MD5:	E361F03F6DA60E8AEC6237D11E70B8AD
SHA1:	5C68D8A6275747EF91F76E235DB764DE6EB4E2FF
SHA-256:	46126F8FF2CBAF62B711CC33B6ED8D504A1F5CC99E5D93C1384C05AA7F4B2ECD
SHA-512:	0622643AF933EA93CA86394118E68E106A207382C26D894722141D2A8F5615A2A5A9C92A46ABB7E240EA47E1C8A71DEB58D98CD4F71C4B817499BBFBDCE3C558
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........{F~.(F~.(F~.(O.8(U~.(F~.(.\|.(O.>(\~.(O.((.~.(O./(.~.(O.!(A~.(O.?(G~.(O.:(G~.(RichF~.(................PE..L.....Gg............................./............@.................................Rwd.............................................. ..(............0d..(..........`................................i..@...................D........................text............................... ..`.rdata..............................@..@.data....^......."..................@....rsrc...(.... ......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF065391EBF2CC40E1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0A3F21C9ABE145A3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1FF2901819542AF9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2499382861587467
Encrypted:	false
SSDEEP:	48:TgduksPveFXJfT5P1UqISoedGPdGfoHprfStedGPdGRub1n:Mdr3TTxItdox
MD5:	83C15F48B021470C1B32DF827D518B2E
SHA1:	601DD2676473C4C27C5CCDAE2EF921E482217BA5
SHA-256:	B342A03E823C86E3F76CB8F5F646D291653A9E3C806D756C4817B4CEEE101D7B
SHA-512:	D4E592041CB34506448E99310207A97375A1AF2A286E03969E83D01C891D47B39816FD79F0D30D0FFB86FD5A272D8F542A6F24A82C8142B3F7F3AF51B6170217
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Temp\~DF1FF2901819542AF9.TMP, Author: Joe Security
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF49C6D83430A3FBE8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.560528538853144
Encrypted:	false
SSDEEP:	48:08PhluRc06WXJeFT5P1UqISoedGPdGfoHprfStedGPdGRub1n:Lhl11FTTxItdox
MD5:	F7ECF42F4FF5BE4C945E776ECB97055B
SHA1:	1C5FDD2C88CD2F08605EB124AFF9ABB6223B8688
SHA-256:	4A8602C0C29832875B2817622F5EDCC222D374FBD49AC99BF7BF02C452ACA4BA
SHA-512:	80F3C55BFE6AA3B7D2AF1381A6C10066A4CA07DD1AE1CD286749B412DE8C4CE49C4B1A0AA5CEF488BBBA401BD39C1276CDA3BBBCE3DE18CE72461521DB180B76
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Temp\~DF49C6D83430A3FBE8.TMP, Author: Joe Security
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4EFA9AAB73D0778C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2499382861587467
Encrypted:	false
SSDEEP:	48:TgduksPveFXJfT5P1UqISoedGPdGfoHprfStedGPdGRub1n:Mdr3TTxItdox
MD5:	83C15F48B021470C1B32DF827D518B2E
SHA1:	601DD2676473C4C27C5CCDAE2EF921E482217BA5
SHA-256:	B342A03E823C86E3F76CB8F5F646D291653A9E3C806D756C4817B4CEEE101D7B
SHA-512:	D4E592041CB34506448E99310207A97375A1AF2A286E03969E83D01C891D47B39816FD79F0D30D0FFB86FD5A272D8F542A6F24A82C8142B3F7F3AF51B6170217
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Temp\~DF4EFA9AAB73D0778C.TMP, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Temp\~DF4EFA9AAB73D0778C.TMP, Author: Joe Security
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9704AEDE6B68F3C0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9FF1E50122603E78.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA435798A112F205E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB522218AED2B124F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2499382861587467
Encrypted:	false
SSDEEP:	48:TgduksPveFXJfT5P1UqISoedGPdGfoHprfStedGPdGRub1n:Mdr3TTxItdox
MD5:	83C15F48B021470C1B32DF827D518B2E
SHA1:	601DD2676473C4C27C5CCDAE2EF921E482217BA5
SHA-256:	B342A03E823C86E3F76CB8F5F646D291653A9E3C806D756C4817B4CEEE101D7B
SHA-512:	D4E592041CB34506448E99310207A97375A1AF2A286E03969E83D01C891D47B39816FD79F0D30D0FFB86FD5A272D8F542A6F24A82C8142B3F7F3AF51B6170217
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Temp\~DFB522218AED2B124F.TMP, Author: Joe Security
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBDF63F9E0954AA6F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.1411585697975447
Encrypted:	false
SSDEEP:	48:CnVubmStedGPdGeqISoedGPdGfoHpr3B:icyLIt9
MD5:	CD915809840A0EEA8A4BD3B0B5AA84CB
SHA1:	F5C8B0C7C527552F99B9AE74DC71D4EBE5323519
SHA-256:	16E7A83FB6523D9D42FA30BF27FDE39BE789FF5C5428F5E82CA7EA4FEF744652
SHA-512:	6CB1F9B35F39F35C8357F54906BBB77CB50A7516A9E3130426FCB64E38C63071BACA17B82A52D3199A34BCECC456A8A1D354CF014EB15F00D8C39B947F4093F2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Temp\~DFBDF63F9E0954AA6F.TMP, Author: Joe Security
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC6C12797E6E975B3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07061710871766691
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOjldMyIHEqVky6lf1:2F0i8n0itFzDHFp2bHWd
MD5:	0A22BF7D872C940B33FE3BEDE138565C
SHA1:	B1DDA6AA7DE5936E497093C219FF40C5A32BE56F
SHA-256:	2D2B1AD35A1FF909E1CCA6D39AC8C3B36B1F37FCD6EAFFEAFEC3EEA6418D89EB
SHA-512:	4F913664AA6A2AA66E9A2FA5739E2EEF9AF54154A4885FBABFD97A2520042011BC50B5B64A18127655F11F70F92C8879713A8EEA66D32EF0756D367A0DD19422
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCC6C8BB60B211B04.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.560528538853144
Encrypted:	false
SSDEEP:	48:08PhluRc06WXJeFT5P1UqISoedGPdGfoHprfStedGPdGRub1n:Lhl11FTTxItdox
MD5:	F7ECF42F4FF5BE4C945E776ECB97055B
SHA1:	1C5FDD2C88CD2F08605EB124AFF9ABB6223B8688
SHA-256:	4A8602C0C29832875B2817622F5EDCC222D374FBD49AC99BF7BF02C452ACA4BA
SHA-512:	80F3C55BFE6AA3B7D2AF1381A6C10066A4CA07DD1AE1CD286749B412DE8C4CE49C4B1A0AA5CEF488BBBA401BD39C1276CDA3BBBCE3DE18CE72461521DB180B76
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Windows\Temp\~DFCC6C8BB60B211B04.TMP, Author: Joe Security
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:Cy:Cy
MD5:	17C47928D1BA7ECB789EE3E4E7BB61A4
SHA1:	58836A68D7DA82082C676A5E1F5BC33F2A8CADF0
SHA-256:	42A3ABE36D8E5C5CB6123D9DA9ADB152C87AD6E08CB6327BB5405A8E297635E4
SHA-512:	EF35FF11C834B9F6696C0EB1FA3F32A3DAE4C304AB872E2A5357D539DDA15C3AC7BD618B5AE8628BCF42BC9B47AFE0C6796816318B2E10B8378EDAFD953EE336
Malicious:	false
Preview:	52..

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AteraAgent, Author: Atera networks, Keywords: Installer, Comments: This installer database contains the logic and data required to install AteraAgent., Template: Intel;1033, Revision Number: {721AD955-79FD-4019-BBF5-9DCC4C1175BB}, Create Time/Date: Wed Feb 28 10:52:02 2024, Last Saved Time/Date: Wed Feb 28 10:52:02 2024, Number of Pages: 200, Number of Words: 6, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Entropy (8bit):	7.878674703733536
TrID:	Microsoft Windows Installer (60509/1) 57.88% ClickyMouse macro set (36024/1) 34.46% Generic OLE2 / Multistream Compound File (8008/1) 7.66%
File name:	RQ--029.msi
File size:	2'994'176 bytes
MD5:	7ba4b194ce0469587c99e7b6b9eae46e
SHA1:	a858d6167b1d1c446d6c176e016b38651d569580
SHA256:	da46033b88ea09024d4dfb1e604f57b1ecbddfa630414190742e7a6e9e8d4ff3
SHA512:	c54dc5e7a01c1491d05983cbc94dc50ec17cb7d14c5ec76d46df681f637f76403f7fc10d9644952d8819153bd56d91be628286f5d2de0a4b00c26d7efa173963
SSDEEP:	49152:6+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:6+lUlz9FKbsodq0YaH7ZPxMb8tT
TLSH:	3DD523127584483AE37B0A358D7AD6A05E7DFE605B70CA8E9308741E2D705C1AB76FB3
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T11:16:10.007208+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49773	13.232.67.198	443	TCP
2024-12-12T11:16:25.031959+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49813	13.232.67.198	443	TCP
2024-12-12T11:16:30.203517+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49832	13.232.67.198	443	TCP
2024-12-12T11:16:36.324207+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49852	13.232.67.198	443	TCP
2024-12-12T11:16:39.208261+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49864	13.232.67.198	443	TCP
2024-12-12T11:16:44.855086+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49892	13.232.67.198	443	TCP
2024-12-12T11:16:45.598781+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49895	13.232.67.198	443	TCP
2024-12-12T11:16:51.921442+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49931	13.232.67.198	443	TCP
2024-12-12T11:16:58.269673+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49963	13.232.67.198	443	TCP
2024-12-12T11:17:04.007381+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49987	13.232.67.198	443	TCP
2024-12-12T11:17:17.380101+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50022	13.232.67.198	443	TCP
2024-12-12T11:17:19.905420+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50036	52.222.144.9	443	TCP
2024-12-12T11:17:23.927154+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50045	52.222.144.9	443	TCP
2024-12-12T11:17:26.679462+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50056	52.222.144.9	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 11:15:18.436389923 CET	49746	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:18.436417103 CET	443	49746	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:18.436706066 CET	49746	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:18.446415901 CET	49746	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:18.446429968 CET	443	49746	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:18.504404068 CET	49747	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:18.504452944 CET	443	49747	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:18.504667044 CET	49747	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:18.513976097 CET	49747	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:18.514015913 CET	443	49747	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:20.763639927 CET	443	49746	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:20.763823032 CET	49746	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:20.789447069 CET	49746	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:20.789477110 CET	443	49746	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:20.790555000 CET	443	49746	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:20.801465034 CET	49746	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:20.828237057 CET	443	49747	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:20.828315020 CET	49747	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:20.830651045 CET	49747	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:20.830656052 CET	443	49747	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:20.831482887 CET	443	49747	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:20.832652092 CET	49747	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:20.843323946 CET	443	49746	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:20.875334978 CET	443	49747	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:21.313914061 CET	443	49746	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:21.313987017 CET	443	49746	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:21.314054012 CET	49746	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:21.346796036 CET	443	49747	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:21.346954107 CET	443	49747	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:21.347052097 CET	49747	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:21.366298914 CET	49746	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:21.387260914 CET	49747	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:21.897747040 CET	49751	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:21.897794008 CET	443	49751	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:21.897881985 CET	49751	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:21.898320913 CET	49751	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:21.898359060 CET	443	49751	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:22.139064074 CET	49752	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:22.139092922 CET	443	49752	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:22.139166117 CET	49752	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:22.140152931 CET	49752	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:22.140167952 CET	443	49752	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:24.205825090 CET	443	49751	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:24.216851950 CET	49751	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:24.216922045 CET	443	49751	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:24.442251921 CET	443	49752	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:24.444354057 CET	49752	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:24.444366932 CET	443	49752	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:24.728250027 CET	443	49751	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:24.728322029 CET	443	49751	13.232.67.198	192.168.2.4
Dec 12, 2024 11:15:24.728418112 CET	49751	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:15:24.736090899 CET	49751	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:06.922688961 CET	49773	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:06.922743082 CET	443	49773	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:06.922822952 CET	49773	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:06.923595905 CET	49773	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:06.923609018 CET	443	49773	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:09.492234945 CET	443	49773	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:09.494414091 CET	49773	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:09.494453907 CET	443	49773	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:10.007239103 CET	443	49773	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:10.007302999 CET	443	49773	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:10.007369995 CET	49773	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:10.007962942 CET	49773	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:10.009073019 CET	49779	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:10.009104967 CET	443	49779	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:10.009175062 CET	49779	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:10.009490013 CET	49779	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:10.009501934 CET	443	49779	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:12.320458889 CET	443	49779	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:12.321557999 CET	49779	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:12.321583033 CET	443	49779	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:12.877568007 CET	443	49779	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:12.877662897 CET	443	49779	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:12.877717972 CET	49779	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:12.878523111 CET	49779	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:21.950798988 CET	443	49752	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:21.950854063 CET	443	49752	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:21.950901031 CET	49752	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:21.950917959 CET	443	49752	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:21.950995922 CET	443	49752	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:21.951044083 CET	49752	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:21.952271938 CET	49752	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:22.019032001 CET	49813	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:22.019092083 CET	443	49813	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:22.019169092 CET	49813	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:22.019790888 CET	49814	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:22.019799948 CET	443	49814	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:22.019876003 CET	49814	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:22.020103931 CET	49814	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:22.020112991 CET	443	49814	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:22.020390987 CET	49813	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:22.020418882 CET	443	49813	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:22.259727001 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:22.259761095 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:22.259860992 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:22.260200977 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:22.260211945 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:23.850224018 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:23.850301981 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:23.852298021 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:23.852305889 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:23.852541924 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:23.853372097 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:23.895329952 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.325907946 CET	443	49814	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:24.327339888 CET	49814	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:24.327354908 CET	443	49814	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:24.430929899 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.430995941 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.431041002 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.431062937 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.431082964 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.431096077 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.431130886 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.519197941 CET	443	49813	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:24.520657063 CET	49813	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:24.520698071 CET	443	49813	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:24.617494106 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.617559910 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.617575884 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.617590904 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.617618084 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.617634058 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.697995901 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.698021889 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.698082924 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.698101997 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.698131084 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.698156118 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.789851904 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.789884090 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.789988995 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.790021896 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.793140888 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.832104921 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.832170010 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.832223892 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.832231998 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.832276106 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.854204893 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.854274035 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.854294062 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.854301929 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.854326963 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.854326963 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.854341030 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.873636007 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.873684883 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.873749018 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.873758078 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.873795986 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.873817921 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.972701073 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.972739935 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.972829103 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.972855091 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.973907948 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.992223024 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.992288113 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.992342949 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.992362976 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:24.992391109 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:24.992407084 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.006351948 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.006400108 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.006447077 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.006453991 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.006481886 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.006505013 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.022197008 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.022267103 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.022320032 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.022331953 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.022371054 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.022380114 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.032048941 CET	443	49813	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:25.032192945 CET	443	49813	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:25.032299042 CET	49813	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:25.033132076 CET	49813	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:25.037489891 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.037539005 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.037595987 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.037609100 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.037643909 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.037662029 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.052242041 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.052304983 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.052356958 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.052388906 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.052416086 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.053924084 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.067837000 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.067898035 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.068028927 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.068043947 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.068166971 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.155414104 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.155478954 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.155539989 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.155554056 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.155606031 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.167126894 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.167171955 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.167196035 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.167205095 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.167268991 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.178044081 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.178087950 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.178133965 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.178147078 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.178191900 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.188896894 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.188946962 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.188977003 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.188986063 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.189013958 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.189042091 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.197007895 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.197052956 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.197086096 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.197096109 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.197127104 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.197148085 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.206020117 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.206064939 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.206119061 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.206127882 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.206182957 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.215776920 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.215820074 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.215848923 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.215858936 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.215888023 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.215909958 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.225023985 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.225066900 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.225104094 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.225112915 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.225143909 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.225164890 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.349071980 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.349137068 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.349186897 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.349205971 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.349237919 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.349472046 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.351582050 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.351661921 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.351670980 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.351764917 CET	443	49815	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:25.352034092 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:25.352137089 CET	49815	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:27.284717083 CET	49814	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:27.284864902 CET	443	49814	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:27.284923077 CET	49814	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:27.301388025 CET	49830	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:27.301420927 CET	443	49830	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:27.301480055 CET	49830	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:27.302264929 CET	49830	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:27.302275896 CET	443	49830	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:27.318262100 CET	49832	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:27.318360090 CET	443	49832	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:27.318438053 CET	49832	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:27.318795919 CET	49832	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:27.318828106 CET	443	49832	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:29.615083933 CET	443	49830	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:29.615189075 CET	49830	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:29.627121925 CET	443	49832	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:29.627341986 CET	49832	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:29.685240030 CET	49832	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:29.685287952 CET	443	49832	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:29.686048031 CET	443	49832	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:29.688508987 CET	49832	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:29.731328011 CET	443	49832	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:29.826679945 CET	49830	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:29.826714039 CET	443	49830	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:29.827727079 CET	443	49830	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:29.830022097 CET	49830	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:29.875335932 CET	443	49830	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:30.203653097 CET	443	49832	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:30.203833103 CET	443	49832	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:30.203955889 CET	49832	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:30.204463959 CET	49832	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:30.387339115 CET	443	49830	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:30.431947947 CET	49830	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:30.431969881 CET	443	49830	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:30.432777882 CET	49830	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:30.432888985 CET	443	49830	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:30.432948112 CET	49830	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:30.434082031 CET	49842	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:30.434123993 CET	443	49842	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:30.434184074 CET	49842	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:30.434446096 CET	49842	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:30.434458971 CET	443	49842	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:32.969199896 CET	443	49842	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:32.969264984 CET	49842	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:32.971111059 CET	49842	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:32.971116066 CET	443	49842	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:32.971451998 CET	443	49842	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:32.972512007 CET	49842	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:33.019329071 CET	443	49842	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:33.484528065 CET	443	49842	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:33.484707117 CET	443	49842	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:33.484757900 CET	49842	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:33.485230923 CET	49842	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:33.490397930 CET	49852	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:33.490489006 CET	443	49852	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:33.490925074 CET	49852	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:33.491642952 CET	49853	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:33.491676092 CET	443	49853	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:33.491746902 CET	49853	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:33.491993904 CET	49853	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:33.492007971 CET	443	49853	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:33.492481947 CET	49852	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:33.492523909 CET	443	49852	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:35.507283926 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:35.507375956 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:35.507472992 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:35.507672071 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:35.507715940 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:35.801762104 CET	443	49853	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:35.801852942 CET	443	49852	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:35.812191010 CET	49853	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:35.812211990 CET	443	49853	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:35.812864065 CET	49852	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:35.812921047 CET	443	49852	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:36.324317932 CET	443	49852	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:36.324506044 CET	443	49852	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:36.324593067 CET	49852	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.325067997 CET	49852	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.328874111 CET	443	49853	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:36.328922987 CET	443	49853	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:36.328993082 CET	49853	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.329013109 CET	443	49853	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:36.332309961 CET	49853	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.345585108 CET	443	49853	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:36.345644951 CET	49853	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.345652103 CET	443	49853	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:36.345738888 CET	443	49853	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:36.345802069 CET	49853	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.346142054 CET	49853	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.362023115 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:36.362056017 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:36.362124920 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:36.362360001 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:36.362375021 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:36.369000912 CET	49864	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.369035959 CET	443	49864	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:36.369183064 CET	49864	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.370004892 CET	49864	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.370021105 CET	443	49864	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:36.370889902 CET	49865	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.370922089 CET	443	49865	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:36.371220112 CET	49865	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.371552944 CET	49865	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:36.371577978 CET	443	49865	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:37.103697062 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.104998112 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:37.105073929 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.682135105 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.682195902 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.682238102 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.682279110 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:37.682353020 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.682372093 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:37.682420969 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:37.861938000 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.862013102 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.862056017 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:37.862108946 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.862149000 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:37.862171888 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:37.907737970 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.907785892 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.907959938 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:37.907959938 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:37.908025980 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.908107996 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:37.967864037 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:37.969487906 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:37.969496012 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.034866095 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.034929991 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.035062075 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.035062075 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.035129070 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.035188913 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.063715935 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.063760996 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.063869953 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.063869953 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.063903093 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.063949108 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.085351944 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.085411072 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.085534096 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.085534096 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.085601091 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.085655928 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.106703997 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.106749058 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.106894016 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.106894016 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.106961012 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.107022047 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.222879887 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.222955942 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.222981930 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.223017931 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.223048925 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.223071098 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.238681078 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.238732100 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.238769054 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.238785028 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.238836050 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.238836050 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.253989935 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.254038095 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.254069090 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.254076958 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.254117966 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.266473055 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.266521931 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.266552925 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.266560078 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.266603947 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.282315969 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.282361031 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.282401085 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.282413006 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.282452106 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.282473087 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.295427084 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.295475006 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.295500994 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.295512915 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.295542955 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.295562029 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.405487061 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.405534029 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.405601025 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.405673981 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.405719042 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.405744076 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.417726040 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.417767048 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.417814016 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.417829037 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.417865992 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.418006897 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.427546978 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.427591085 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.427628040 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.427643061 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.427671909 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.427691936 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.438373089 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.438417912 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.438457012 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.438469887 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.438500881 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.438523054 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.449114084 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.449155092 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.449282885 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.449282885 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.449316978 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.449372053 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.459105015 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.459147930 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.459264040 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.459264040 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.459296942 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.459357977 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.469892979 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.469935894 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.469964027 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.469973087 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.470005035 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.470016003 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.479458094 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.479502916 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.479556084 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.479568958 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.479602098 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.479655981 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.551414967 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.551475048 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.551517963 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.551553011 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.551569939 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.551587105 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.551615000 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.598602057 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.598668098 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.598819017 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.598819017 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.598886013 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.598943949 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.606997967 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.607045889 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.607093096 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.607115984 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.607152939 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.607186079 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.615139008 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.615194082 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.615216970 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.615231037 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.615266085 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.615288019 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.622312069 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.622355938 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.622394085 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.622407913 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.622441053 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.622526884 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.630376101 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.630418062 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.630481005 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.630494118 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.630544901 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.630565882 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.638077021 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.638173103 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.638216972 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.638228893 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.638258934 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.638384104 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.646209002 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.646255016 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.646292925 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.646306038 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.646337032 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.646450043 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.654382944 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.654428959 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.654481888 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.654489994 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.654519081 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.654536009 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.694117069 CET	443	49865	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:38.694331884 CET	443	49864	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:38.695355892 CET	49864	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:38.695373058 CET	443	49864	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:38.709335089 CET	49865	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:38.709348917 CET	443	49865	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:38.722084045 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.722147942 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.722165108 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.722181082 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.722203016 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.722223043 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.769821882 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.769869089 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.769885063 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.769917011 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.769925117 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.769979000 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.790798903 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.790868998 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.791002035 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.791002035 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.791035891 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.791085005 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.798501015 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.798567057 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.798598051 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.798614025 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.798645973 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.798667908 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.806497097 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.806543112 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.806581020 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.806593895 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.806626081 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.806648016 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.813179970 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.813229084 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.813266039 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.813287020 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.813319921 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.813342094 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.820998907 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.821050882 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.821110010 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.821122885 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.821156025 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.821176052 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.828408003 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.828453064 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.828491926 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.828504086 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.828542948 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.828542948 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.836179018 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.836225033 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.836261988 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.836273909 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.836304903 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.836324930 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.844065905 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.844119072 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.844146013 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.844157934 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.844191074 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.844212055 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.892791033 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.892855883 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.892888069 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.892910957 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.892947912 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.892947912 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.912484884 CET	49874	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:38.912513018 CET	443	49874	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:38.912781954 CET	49874	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:38.922108889 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.922159910 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.922190905 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.922224045 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.922241926 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.922269106 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.939058065 CET	49874	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:38.939071894 CET	443	49874	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:38.947783947 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.947854042 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.947907925 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.947916985 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.947951078 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.947972059 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.966197014 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.966248989 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.966289043 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.966296911 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.966340065 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.974514008 CET	49876	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:38.974534035 CET	443	49876	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:38.974643946 CET	49876	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:38.982701063 CET	49876	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:38.982712030 CET	443	49876	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:38.983278036 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.983306885 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.983499050 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.983500004 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.983566999 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.983628035 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.990484953 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.990500927 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.990590096 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.990607977 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.990659952 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.998193979 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.998209000 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.998279095 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:38.998302937 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:38.998352051 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.006063938 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.006081104 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.006149054 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.006162882 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.006191015 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.006211042 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.013051987 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.013066053 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.013149023 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.013161898 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.013216019 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.020303965 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.020318985 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.020371914 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.020387888 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.020416021 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.020484924 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.028193951 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.028209925 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.028264999 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.028278112 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.028331041 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.035893917 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.035909891 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.035967112 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.035980940 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.036007881 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.036051989 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.078891993 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.078957081 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.078974962 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.079006910 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.079026937 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.079046011 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.094568968 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.094618082 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.094647884 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.094659090 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.094691038 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.094713926 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.109025002 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.109074116 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.109092951 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.109102964 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.109127998 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.109150887 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.121635914 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.121678114 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.121706963 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.121715069 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.121742964 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.121757030 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.136221886 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.136270046 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.136295080 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.136303902 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.136333942 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.136344910 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.149522066 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.149566889 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.149586916 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.149594069 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.149621964 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.149641037 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.164047956 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.164180040 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.164194107 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.164237022 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.164244890 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.164283037 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.176007032 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.176023960 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.176085949 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.176117897 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.176161051 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.182809114 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.182825089 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.182903051 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.182919979 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.182974100 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.190550089 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.190572977 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.190642118 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.190658092 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.190689087 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.190752029 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.198436975 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.198451996 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.198497057 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.198508978 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.198538065 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.198657036 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.205329895 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.205344915 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.205408096 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.205420971 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.205468893 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.208373070 CET	443	49864	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:39.213625908 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.213639975 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.213706017 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.213720083 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.213771105 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.220518112 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.220532894 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.220590115 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.220603943 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.220633030 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.220685959 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.228295088 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.228310108 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.228364944 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.228378057 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.228405952 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.228462934 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.260035992 CET	49864	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:39.260046959 CET	443	49864	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:39.260504007 CET	49864	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:39.260775089 CET	443	49864	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:39.260847092 CET	49864	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:39.264436960 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.264489889 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.264508963 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.264522076 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.264543056 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.264556885 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.275835037 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.275883913 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.275913954 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.275921106 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.275953054 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.275964975 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.286667109 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.286731958 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.286772013 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.286791086 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.286811113 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.286833048 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.295576096 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.295625925 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.295644045 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.295653105 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.295697927 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.305366039 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.305412054 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.305438042 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.305453062 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.305488110 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.305497885 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.314306974 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.314356089 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.314388037 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.314395905 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.314431906 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.314450979 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.324152946 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.324220896 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.324239969 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.324251890 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.324279070 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.324390888 CET	443	49863	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.324502945 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.324562073 CET	49863	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.367762089 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.367779970 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.367835999 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.367847919 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.367863894 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.367930889 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.375483036 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.375498056 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.375555038 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.375562906 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.375605106 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.383330107 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.383351088 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.383414030 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.383420944 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.383455992 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.390050888 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.390064955 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.390114069 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.390122890 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.390321016 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.397931099 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.397948027 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.397991896 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.398000002 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.398030043 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.398042917 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.405195951 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.405211926 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.405288935 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.405303955 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.405325890 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.405395985 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.413083076 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.413098097 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.413147926 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.413156033 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.413183928 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.413197041 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.420830965 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.420845985 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.420896053 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.420903921 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.420917034 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.420957088 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.559868097 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.559887886 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.559987068 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.560005903 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.560050964 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.567673922 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.567692041 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.567732096 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.567739964 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.567778111 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.567804098 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.575468063 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.575483084 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.575521946 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.575532913 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.575556993 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.575582027 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.583337069 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.583352089 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.583406925 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.583414078 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.583439112 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.583461046 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.590236902 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.590251923 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.590317965 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.590332031 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.590415001 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.597657919 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.597673893 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.597722054 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.597747087 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.597774982 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.597795963 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.605376005 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.605391026 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.605458975 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.605470896 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.605583906 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.613178015 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.613194942 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.613240957 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.613253117 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.613279104 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.613337994 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.753140926 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.753187895 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.753215075 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.753230095 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.753262043 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.753283978 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.760711908 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.760767937 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.760795116 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.760813951 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.760840893 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.760862112 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.767581940 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.767620087 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.767643929 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.767648935 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.767683983 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.767703056 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.775441885 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.775481939 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.775501013 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.775531054 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.775536060 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.775573969 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.783233881 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.783246994 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.783291101 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.783298016 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.783328056 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.783344984 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.790545940 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.790569067 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.790610075 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.790622950 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.790654898 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.790674925 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.798393965 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.798418045 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.798466921 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.798480034 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.798508883 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.798531055 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.805283070 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.805305958 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.805350065 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.805361986 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.805393934 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.805414915 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.945686102 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.945725918 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.945760965 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.945789099 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.945822954 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.945844889 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.952464104 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.952495098 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.952537060 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.952558994 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.952594995 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.952649117 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.961038113 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.961067915 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.961110115 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.961132050 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.961163044 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.961184978 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.968194962 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.968261957 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.968307972 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.968316078 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.968357086 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.974939108 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.974983931 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.975044966 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.975053072 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.975083113 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.975096941 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.984720945 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.984766960 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.984803915 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.984811068 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.984837055 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.984858990 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.990969896 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.991014004 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.991044044 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.991056919 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.991086960 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.991108894 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.999028921 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.999070883 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.999131918 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.999145031 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:39.999172926 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:39.999195099 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.139080048 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.139101982 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.139168978 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.139202118 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.139283895 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.145764112 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.145786047 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.145823002 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.145832062 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.145869970 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.145888090 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.152730942 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.152749062 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.152791023 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.152798891 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.152815104 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.152847052 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.160465002 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.160485029 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.160542965 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.160559893 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.160604954 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.167376041 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.167393923 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.167455912 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.167469025 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.167530060 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.175632954 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.175656080 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.175700903 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.175708055 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.175731897 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.175745964 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.182586908 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.182631969 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.182657003 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.182663918 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.182684898 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.182697058 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.190376997 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.190401077 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.190452099 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.190474987 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.190500975 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.190545082 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.330391884 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.330415964 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.330543995 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.330543995 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.330576897 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.330842018 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.337274075 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.337291002 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.337342024 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.337359905 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.337392092 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.337425947 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.345120907 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.345139027 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.345180035 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.345190048 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.345220089 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.345241070 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.352884054 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.352899075 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.352951050 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.352961063 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.353001118 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.360745907 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.360765934 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.360809088 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.360816956 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.360848904 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.360873938 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.368102074 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.368122101 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.368171930 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.368180990 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.368211985 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.368231058 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.375040054 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.375086069 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.375107050 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.375116110 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.375142097 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.375153065 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.382889986 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.382940054 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.382957935 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.382967949 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.382996082 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.383011103 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.522936106 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.522984982 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.523024082 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.523053885 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.523082018 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.523104906 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.531533003 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.531582117 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.531605959 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.531625986 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.531646013 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.531677008 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.537735939 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.537784100 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.537806034 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.537820101 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.537859917 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.537859917 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.545833111 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.545878887 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.545919895 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.545933008 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.545989037 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.545989037 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.553316116 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.553363085 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.553390026 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.553404093 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.553433895 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.553455114 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.560775995 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.560823917 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.560853004 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.560866117 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.560904026 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.560904026 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.570393085 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.570439100 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.570470095 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.570482969 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.570511103 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.570530891 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.575397015 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.575442076 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.575478077 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.575490952 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.575522900 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.575545073 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.715549946 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.715610981 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.715640068 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.715661049 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.715687990 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.715709925 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.723573923 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.723642111 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.723655939 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.723670959 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.723700047 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.723721027 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.730534077 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.730581999 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.730608940 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.730623007 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.730654001 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.730675936 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.737988949 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.738034964 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.738074064 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.738094091 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.738123894 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.738163948 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.745750904 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.745765924 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.745814085 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.745827913 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.745861053 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.745887041 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.753192902 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.753213882 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.753256083 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.753268957 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.753295898 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.753415108 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.761044979 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.761063099 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.761121035 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.761136055 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.761187077 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.768218040 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.768234015 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.768287897 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.768302917 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.768345118 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.858243942 CET	49884	443	192.168.2.4	52.223.39.232
Dec 12, 2024 11:16:40.858330965 CET	443	49884	52.223.39.232	192.168.2.4
Dec 12, 2024 11:16:40.858501911 CET	49884	443	192.168.2.4	52.223.39.232
Dec 12, 2024 11:16:40.862730980 CET	49884	443	192.168.2.4	52.223.39.232
Dec 12, 2024 11:16:40.862766027 CET	443	49884	52.223.39.232	192.168.2.4
Dec 12, 2024 11:16:40.908126116 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.908194065 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.908200979 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.908245087 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.908304930 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.908304930 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.915165901 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.915199995 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.915258884 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.915272951 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.915384054 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.915450096 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.923449993 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.923465014 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.923527956 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.923548937 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.923599005 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.930568933 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.930598021 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.930649042 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.930665016 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.930696011 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.930758953 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.938596964 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.938623905 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.938657045 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.938669920 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.938699961 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.938754082 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.946033001 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.946059942 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.946111917 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.946125984 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.946155071 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.946357012 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.952660084 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.952692986 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.952734947 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.952749014 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.952778101 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.952888012 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.960551023 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.960581064 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.960609913 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.960623026 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:40.960654020 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:40.960711002 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.100068092 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.100100994 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.100169897 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.100224018 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.100256920 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.100277901 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.107916117 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.107945919 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.108036995 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.108052015 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.108105898 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.115782976 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.115814924 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.115845919 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.115861893 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.115890026 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.115907907 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.124017954 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.124032021 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.124078989 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.124097109 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.124129057 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.124177933 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.130408049 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.130424023 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.130492926 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.130510092 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.130567074 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.137804985 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.137820959 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.137881994 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.137906075 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.137950897 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.146028996 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.146039009 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.146117926 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.146141052 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.146188021 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.153358936 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.153373957 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.153439999 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.153455019 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.153508902 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.269570112 CET	443	49874	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.269663095 CET	49874	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:41.271404028 CET	49874	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:41.271435976 CET	443	49874	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.271781921 CET	443	49874	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.272702932 CET	49874	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:41.295350075 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.295365095 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.295429945 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.295448065 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.295501947 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.301640987 CET	443	49876	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.301711082 CET	49876	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:41.302083969 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.302099943 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.302150011 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.302164078 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.302196026 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.302217960 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.303148985 CET	49876	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:41.303157091 CET	443	49876	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.303955078 CET	443	49876	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.305279970 CET	49876	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:41.309828997 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.309850931 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.309905052 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.309917927 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.309947968 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.309967041 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.315330029 CET	443	49874	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.317739964 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.317758083 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.317817926 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.317830086 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.317992926 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.318135023 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.325284004 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.325304031 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.325371981 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.325383902 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.325413942 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.325476885 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.332958937 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.332979918 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.333039999 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.333053112 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.333105087 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.339837074 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.339852095 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.339931965 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.339945078 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.340085030 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.347326040 CET	443	49876	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.347554922 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.347572088 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.347635031 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.347650051 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.347702026 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.488492966 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.488514900 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.488604069 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.488626957 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.488725901 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.495349884 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.495367050 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.495450974 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.495464087 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.495577097 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.503196955 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.503225088 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.503262043 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.503287077 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.503310919 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.503345966 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.510195017 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.510211945 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.510376930 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.510445118 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.510524035 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.517839909 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.517858028 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.517915010 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.517931938 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.517983913 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.518002987 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.525300980 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.525316000 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.525372028 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.525386095 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.525424957 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.525446892 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.533020973 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.533035994 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.533081055 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.533101082 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.533127069 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.533166885 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.540920019 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.540935993 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.541009903 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.541023970 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.541099072 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.680006981 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.680027962 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.680098057 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.680166960 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.680210114 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.680433035 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.687772036 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.687788010 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.687865973 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.687905073 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.687944889 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.688002110 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.695770979 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.695790052 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.695877075 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.695900917 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.695962906 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.702497005 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.702513933 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.702579021 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.702589035 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.702641964 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.710836887 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.710872889 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.710930109 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.710943937 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.710973024 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.711112022 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.717693090 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.717714071 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.717760086 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.717767000 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.717798948 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.717817068 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.725496054 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.725518942 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.725574017 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.725580931 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.725620031 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.733303070 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.733318090 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.733401060 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.733417034 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.733524084 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.784738064 CET	443	49874	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.817333937 CET	443	49876	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.872639894 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.872694016 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.872854948 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.872854948 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.872921944 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.873155117 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.880379915 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.880433083 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.880491972 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.880511999 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.880544901 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.880568027 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.888307095 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.888396978 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.888396978 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.888415098 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.888495922 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.895078897 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.895139933 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.895175934 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.895196915 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.895225048 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.895267963 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.902817965 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.902928114 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.902961016 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.902973890 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.903008938 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.903031111 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.910260916 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.910311937 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.910346031 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.910360098 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.910388947 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.910409927 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.918296099 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.918345928 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.918385983 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.918399096 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.918430090 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.918447971 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.925870895 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.925924063 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.925960064 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.925978899 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:41.926006079 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.926196098 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:41.931935072 CET	49874	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:41.931997061 CET	443	49874	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.931999922 CET	49876	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:41.932014942 CET	443	49876	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.932338953 CET	49874	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:41.932631969 CET	443	49874	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.932718039 CET	49874	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:41.933202028 CET	49876	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:41.933377028 CET	443	49876	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.933772087 CET	443	49876	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:41.933825016 CET	49876	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:41.933837891 CET	49876	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.021198988 CET	49892	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.021214008 CET	443	49892	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:42.021893978 CET	49892	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.022641897 CET	49893	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.022679090 CET	443	49893	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:42.022747040 CET	49893	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.022989035 CET	49893	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.022999048 CET	443	49893	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:42.023264885 CET	49892	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.023276091 CET	443	49892	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:42.065684080 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.065738916 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.065890074 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.065890074 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.065956116 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.066015005 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.072864056 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.072920084 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.072945118 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.072961092 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.072993040 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.073307037 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.080674887 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.080719948 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.080749989 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.080763102 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.080809116 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.080832005 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.090565920 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.090615034 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.090652943 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.090666056 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.090693951 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.090769053 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.095984936 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.096035957 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.096076012 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.096087933 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.096117973 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.096184015 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.102672100 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.102724075 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.102758884 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.102778912 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.102811098 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.102957010 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.110516071 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.110541105 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.110584021 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.110595942 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.110644102 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.110644102 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.119738102 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.119786978 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.119813919 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.119827032 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.119853973 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.120141983 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.259660006 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.259708881 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.259856939 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.259857893 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.259923935 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.260001898 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.267396927 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.267452002 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.267489910 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.267520905 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.267551899 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.267574072 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.273179054 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.273236990 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.273271084 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.273288965 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.273315907 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.273338079 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.282207966 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.282258034 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.282315016 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.282329082 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.282362938 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.282383919 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.290003061 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.290055037 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.290079117 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.290091991 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.290122032 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.290487051 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.297292948 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.297343016 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.297377110 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.297389984 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.297420025 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.297478914 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.305313110 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.305365086 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.305393934 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.305406094 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.305435896 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.305963039 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.310946941 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.310996056 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.311043024 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.311055899 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.311095953 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.311116934 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.450377941 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.450432062 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.450608969 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.450608969 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.450685024 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.450740099 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.458151102 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.458206892 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.458261013 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.458278894 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.458322048 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.458344936 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.465944052 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.465998888 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.466036081 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.466049910 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.466084003 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.468899965 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.472892046 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.472965002 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.473001957 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.473016024 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.473050117 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.473067999 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.481220961 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.481296062 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.481317043 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.481331110 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.481364012 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.481409073 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.488009930 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.488055944 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.488110065 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.488122940 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.488152981 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.488174915 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.495832920 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.495882034 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.495930910 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.495949030 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.495975971 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.495996952 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.503576040 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.503633022 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.503674030 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.503700018 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.503727913 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.504889011 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.527965069 CET	443	49884	52.223.39.232	192.168.2.4
Dec 12, 2024 11:16:42.528172016 CET	49884	443	192.168.2.4	52.223.39.232
Dec 12, 2024 11:16:42.530647039 CET	49884	443	192.168.2.4	52.223.39.232
Dec 12, 2024 11:16:42.530677080 CET	443	49884	52.223.39.232	192.168.2.4
Dec 12, 2024 11:16:42.531044960 CET	443	49884	52.223.39.232	192.168.2.4
Dec 12, 2024 11:16:42.572654963 CET	49884	443	192.168.2.4	52.223.39.232
Dec 12, 2024 11:16:42.581918955 CET	49884	443	192.168.2.4	52.223.39.232
Dec 12, 2024 11:16:42.627329111 CET	443	49884	52.223.39.232	192.168.2.4
Dec 12, 2024 11:16:42.643523932 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.643615007 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.643627882 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.643717051 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.643757105 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.643874884 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.650396109 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.650450945 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.650471926 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.650490046 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.650521994 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.650763988 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.658193111 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.658243895 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.658277035 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.658291101 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.658323050 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.658344030 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.665899038 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.665966988 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.665991068 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.666004896 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.666034937 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.666057110 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.672796965 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.672844887 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.672863007 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.672878027 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.672929049 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.672950029 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.681098938 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.681144953 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.681170940 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.681184053 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.681214094 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.682102919 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.687979937 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.688034058 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.688060045 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.688074112 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.688102961 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.688158035 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.695847034 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.695873976 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.696001053 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.696017027 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.696077108 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.746676922 CET	49865	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.746853113 CET	443	49865	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:42.747096062 CET	443	49865	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:42.747616053 CET	49894	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.747637033 CET	443	49894	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:42.747663975 CET	49865	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.747663975 CET	49865	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.747698069 CET	49894	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.749245882 CET	49894	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.749258041 CET	443	49894	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:42.751269102 CET	49895	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.751302958 CET	443	49895	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:42.751363993 CET	49895	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.752779007 CET	49895	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:42.752790928 CET	443	49895	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:42.835889101 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.836009979 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.836019993 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.836044073 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.836078882 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.836078882 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.842699051 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.842767000 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.842771053 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.842797995 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.842823982 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.842849970 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.850555897 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.850605011 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.850630045 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.850645065 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.850673914 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.850714922 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.858351946 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.858396053 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.858419895 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.858433008 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.858462095 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.859020948 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.865179062 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.865235090 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.865263939 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.865277052 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.865305901 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.865349054 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.873491049 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.873539925 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.873567104 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.873584032 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.873598099 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.873622894 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.880770922 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.880819082 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.880846977 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.880860090 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.880888939 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.880908012 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.888262987 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.888324022 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.888331890 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.888359070 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:42.888386011 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.888411999 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:42.967679977 CET	443	49884	52.223.39.232	192.168.2.4
Dec 12, 2024 11:16:42.967798948 CET	443	49884	52.223.39.232	192.168.2.4
Dec 12, 2024 11:16:42.967936039 CET	49884	443	192.168.2.4	52.223.39.232
Dec 12, 2024 11:16:42.969115973 CET	49884	443	192.168.2.4	52.223.39.232
Dec 12, 2024 11:16:43.028227091 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.028276920 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.028333902 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.028348923 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.028381109 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.028402090 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.035047054 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.035092115 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.035144091 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.035159111 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.035188913 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.035211086 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.042921066 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.042977095 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.043019056 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.043037891 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.043067932 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.043088913 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.050705910 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.050751925 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.050800085 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.050813913 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.050843000 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.050869942 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.058543921 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.058621883 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.058635950 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.058645964 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.058676958 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.058701992 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.065895081 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.065958023 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.065968990 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.065975904 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.066016912 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.066035986 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.072823048 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.072875977 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.072900057 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.072906971 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.072946072 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.080645084 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.080693960 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.080724955 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.080733061 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.080761909 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.080773115 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.117793083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:43.117881060 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:43.117973089 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:43.118433952 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:43.118469954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:43.220731020 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.220777988 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.220820904 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.220846891 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.220871925 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.220961094 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.228560925 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.228615046 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.228637934 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.228651047 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.228696108 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.228741884 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.235399008 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.235425949 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.235469103 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.235482931 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.235512018 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.235533953 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.243118048 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.243134975 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.243310928 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.243343115 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.244492054 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.251100063 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.251115084 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.251171112 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.251185894 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.251215935 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.251328945 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.257426023 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.257457018 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.257488012 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.257502079 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.257539988 CET	443	49860	52.222.144.9	192.168.2.4
Dec 12, 2024 11:16:43.257543087 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.257596016 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:43.258039951 CET	49860	443	192.168.2.4	52.222.144.9
Dec 12, 2024 11:16:44.328285933 CET	443	49893	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:44.328521967 CET	49893	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:44.329853058 CET	49893	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:44.329866886 CET	443	49893	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:44.330075979 CET	443	49893	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:44.330861092 CET	49893	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:44.337507010 CET	443	49892	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:44.337712049 CET	49892	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:44.341844082 CET	49892	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:44.341859102 CET	443	49892	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:44.342627048 CET	443	49892	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:44.343664885 CET	49892	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:44.371367931 CET	443	49893	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:44.387357950 CET	443	49892	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:44.737468004 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:44.737606049 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:44.739352942 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:44.739367008 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:44.739773035 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:44.741153002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:44.787343979 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:44.855189085 CET	443	49892	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:44.855376005 CET	443	49892	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:44.855468035 CET	49892	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:44.856693029 CET	49892	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.056598902 CET	443	49894	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.056679964 CET	49894	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.058511972 CET	49894	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.058521032 CET	443	49894	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.058933973 CET	443	49894	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.060904980 CET	49894	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.076657057 CET	443	49895	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.076742887 CET	49895	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.078097105 CET	49895	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.078107119 CET	443	49895	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.078891993 CET	443	49895	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.079974890 CET	49895	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.107326031 CET	443	49894	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.123331070 CET	443	49895	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.598901987 CET	443	49895	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.599107981 CET	443	49895	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.599294901 CET	49895	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.599719048 CET	49895	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.600565910 CET	49908	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.600593090 CET	443	49908	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.600696087 CET	49908	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.600903034 CET	49908	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.600917101 CET	443	49908	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.618225098 CET	443	49894	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.744499922 CET	49894	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.744518995 CET	443	49894	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.745150089 CET	49894	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.745322943 CET	443	49894	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.745752096 CET	443	49894	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.745831013 CET	49894	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.745848894 CET	49894	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.746326923 CET	49912	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.746356010 CET	443	49912	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.746747017 CET	49912	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.746928930 CET	49912	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:45.746942997 CET	443	49912	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:45.980031013 CET	49912	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:46.023324013 CET	443	49912	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:46.030292988 CET	49913	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:46.030380011 CET	443	49913	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:46.031960011 CET	49913	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:46.032351017 CET	49913	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:46.032387018 CET	443	49913	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:46.064156055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.064222097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.064266920 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.064301014 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.064372063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.064409018 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.064434052 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.242393017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.242455959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.242507935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.242575884 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.242671967 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.242695093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.289172888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.289231062 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.289275885 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.289345026 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.289386988 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.289410114 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.416301012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.416361094 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.416397095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.416446924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.416477919 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.416537046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.439883947 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.439933062 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.439969063 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.439985037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.440021038 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.440043926 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.466379881 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.466439962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.466475010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.466492891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.466525078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.466564894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.492769957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.492820024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.492861986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.492877960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.492908001 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.492932081 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.600119114 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.600212097 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.600236893 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.600327969 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.603091955 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.603154898 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.620260000 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.620315075 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.620347977 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.620362043 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.620398998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.638201952 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.638257980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.638309956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.638333082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.638364077 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.653220892 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.653265953 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.653300047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.653322935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.653352976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.662849903 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.662893057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.662930012 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.662951946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.662998915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.663002014 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.663028002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.663039923 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.663100958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.674875975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.674921989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.674966097 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.674981117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.675023079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.675046921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.785847902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.785917044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.785943031 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.785959005 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.786004066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.786026001 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.795182943 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.795234919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.795257092 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.795305014 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.795336008 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.795391083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.804703951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.804755926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.804784060 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.804797888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.804830074 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.804852009 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.812448978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.812493086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.812532902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.812557936 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.812586069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.812608004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.821543932 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.821588039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.821621895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.821646929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.821671009 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.821705103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.830413103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.830466032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.830502987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.830523968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.830549002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.830573082 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.837591887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.837658882 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.837671995 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.837692022 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.837722063 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.838896036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.839226961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.839242935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.848020077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.848086119 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.848107100 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.848133087 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.848164082 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.932415009 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.977333069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.977365971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.977413893 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.977462053 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.977462053 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.977492094 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.977565050 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.977602959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.977953911 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.984530926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.984572887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.984621048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.984636068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.984675884 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.984937906 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.991945982 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.992022991 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.992068052 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.992083073 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.992119074 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.992423058 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.998672009 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.998714924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.998826027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.998826981 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:46.998846054 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:46.999042034 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.006541014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.006583929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.006705999 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.006706953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.006728888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.007360935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.014142990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.014185905 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.014230013 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.014244080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.014276028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.014322042 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.020292044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.020375967 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.020384073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.020416021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.020452976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.021357059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.021554947 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.021570921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.029079914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.029131889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.029181957 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.029217958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.029269934 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.169089079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.169136047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.171982050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.172050953 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.176287889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.176307917 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.176326036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.176377058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.176393986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.176394939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.176397085 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.176415920 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.176429987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.176446915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.176481962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.184042931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.184087992 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.184107065 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.184125900 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.184130907 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.184145927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.184159040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.184161901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.184190989 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.190805912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.190855980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.190890074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.190896988 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.190913916 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.190953016 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.190953016 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.198533058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.198575974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.198627949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.198643923 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.198676109 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.206202030 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.206254959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.206304073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.206326008 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.206394911 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.213464975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.213505983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.213608027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.213608027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.213624954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.221153021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.221201897 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.221256018 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.221271992 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.221317053 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.361712933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.361773014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.361838102 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.361838102 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.361908913 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.368437052 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.368455887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.368475914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.368522882 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.368525028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.368542910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.368557930 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.368562937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.368580103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.368590117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.368628025 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.375072956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.375118971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.375138998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.375164986 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.375164986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.375197887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.375230074 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.375283957 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.376107931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.376208067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.383855104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.383934975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.383981943 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.383995056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.384027004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.384047985 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.390654087 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.390696049 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.390738010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.390752077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.390842915 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.390842915 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.398394108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.398437977 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.398545027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.398567915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.398600101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.398726940 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.405669928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.405745029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.405805111 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.405826092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.405860901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.405910969 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.413218975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.413296938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.413341999 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.413355112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.413389921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.413409948 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.553811073 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.553859949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.553965092 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.553965092 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.554033041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.554250956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.560487032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.560528994 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.560566902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.560580969 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.560619116 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.560792923 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.567197084 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.567260981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.567306995 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.567322016 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.567373991 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.568200111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.568298101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.568314075 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.575890064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.575946093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.575997114 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.576023102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.576050043 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.582633018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.582675934 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.582724094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.582739115 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.582768917 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.590430021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.590483904 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.590656042 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.590670109 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.590713978 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.597439051 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.597465992 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.597537041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.597585917 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.597604036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.597753048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.605209112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.605223894 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.605326891 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.605340004 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.744520903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.745620012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.745644093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.745717049 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.745752096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.745800018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.745834112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.745835066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.745835066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.745871067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.746078968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.752309084 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.752320051 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.752367020 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.752423048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.752423048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.752443075 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.752846003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.758991957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.759042978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.759104013 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.759104013 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.759119987 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.760061026 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.760129929 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.760144949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.767719030 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.767746925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.767854929 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.767855883 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.767874002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.775492907 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.775512934 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.775588036 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.775609016 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.775635958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.900790930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.900824070 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:47.900913954 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.900913954 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:47.900985956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.041418076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.139537096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.139549017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.139625072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.139661074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.139693022 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.139727116 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.139739990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.139759064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.139790058 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.139790058 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.139817953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.140899897 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.140928984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.140970945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.140979052 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.140989065 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.141000032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.141028881 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.141043901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.141043901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.141068935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.141700983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.141720057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.141758919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.141761065 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.141777992 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.141793013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.141822100 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.141840935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.142534018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.142592907 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.142620087 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.142633915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.142657995 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.142677069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.143815041 CET	443	49908	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:48.144283056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.144324064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.144361019 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.144372940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.144399881 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.144421101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.145281076 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.145325899 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.145359993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.145371914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.145404100 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.145425081 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.146203995 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.146245956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.146269083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.146281004 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.146308899 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.146330118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.147008896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.147130013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.147175074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.147226095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.147242069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.147264957 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.147336006 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.148669958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.148715019 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.148758888 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.148772955 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.148812056 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.148832083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.149811029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.149852037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.149897099 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.149914026 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.149940968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.150733948 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.150784969 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.150808096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.150846004 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.150892019 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.150892019 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.150913954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.150938988 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.150959969 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.151233912 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.151505947 CET	443	49912	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:48.151555061 CET	49912	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:48.151578903 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.151619911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.151678085 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.151694059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.151743889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.151743889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.152523041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.152622938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.152645111 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.152657986 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.152686119 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.152707100 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.153462887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.153507948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.153532982 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.153549910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.153583050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.153604984 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.159581900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.159626961 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.159670115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.159684896 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.159713030 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.160156012 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.166337967 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.166383982 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.166413069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.166424990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.166450977 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.166467905 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.167599916 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.244680882 CET	49908	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:48.259835958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.259902000 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.259978056 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.260041952 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.260134935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.260134935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.265630007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.265682936 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.265739918 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.265755892 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.265793085 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.267904997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.321415901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.321471930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.321547985 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.321547985 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.321614981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.321671009 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.328897953 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.328944921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.328993082 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.329014063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.329040051 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.331906080 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.336544037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.336611032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.336653948 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.336671114 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.336694956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.339513063 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.344858885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.344903946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.345052958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.345053911 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.345120907 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.345182896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.351031065 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.351104021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.351120949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.351188898 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.351237059 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.351237059 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.358798981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.358844995 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.358891964 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.358963966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.359003067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.359026909 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.366023064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.366075039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.366218090 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.366218090 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.366286039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.366344929 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.373671055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.373725891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.373878956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.373878956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.373945951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.374003887 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.513931990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.513997078 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.514061928 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.514061928 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.514130116 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.514183998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.520303011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.520353079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.520389080 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.520402908 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.520431995 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.520452976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.526247025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.526293993 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.526316881 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.526329041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.526357889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.526377916 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.530901909 CET	49908	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:48.530926943 CET	443	49908	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:48.533061028 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.533113003 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.533132076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.533144951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.533174038 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.533196926 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.539757967 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.539803028 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.539825916 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.539838076 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.539869070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.539890051 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.545653105 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.545698881 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.545774937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.545787096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.545819998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.545851946 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.552998066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.553044081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.553081989 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.553095102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.553144932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.553144932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.558813095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.558867931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.558876991 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.558898926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.558933973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.558958054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.653424025 CET	443	49913	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:48.653495073 CET	49913	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:48.656971931 CET	49913	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:48.656976938 CET	443	49913	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:48.657250881 CET	443	49913	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:48.658826113 CET	49913	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:48.699330091 CET	443	49913	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:48.705607891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.705667019 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.705810070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.705810070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.705877066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.705938101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.712282896 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.712332964 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.712368011 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.712383986 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.712416887 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.712438107 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.718215942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.718261957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.718312979 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.718331099 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.718354940 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.720088005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.725076914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.725121975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.725157022 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.725173950 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.725200891 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.725222111 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.731746912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.731800079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.731846094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.731863976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.731887102 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.731914997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.738607883 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.738652945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.738688946 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.738706112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.738728046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.738755941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.744903088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.744949102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.744982004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.744996071 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.745033026 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.745033026 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.745059013 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.750719070 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.750763893 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.750802040 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.750813007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.750839949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.750884056 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.900605917 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.900675058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.900809050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.900810003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.900876999 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.900933981 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.906786919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.906836033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.906887054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.906908035 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.906933069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.908384085 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.913451910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.913506031 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.913532972 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.913546085 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.913578987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.913600922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.920186043 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.920238972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.920286894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.920300007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.920325994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.923918962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.926911116 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.926956892 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.927000999 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.927011967 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.927042007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.927959919 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.933090925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.933140039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.933161974 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.933175087 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.933203936 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.933222055 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.939263105 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.939341068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.939352036 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.939378023 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.939403057 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.939424992 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.945962906 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.946007967 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.946043015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.946054935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:48.946084023 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:48.946103096 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.092549086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.092611074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.092658043 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.092730999 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.092772007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.092798948 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.092839956 CET	443	49908	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:49.092997074 CET	443	49908	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:49.093054056 CET	49908	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:49.093599081 CET	49908	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:49.094479084 CET	49931	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:49.094496965 CET	443	49931	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:49.094579935 CET	49931	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:49.094939947 CET	49931	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:49.094953060 CET	443	49931	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:49.099531889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.099579096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.099602938 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.099620104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.099651098 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.099669933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.105360031 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.105397940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.105431080 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.105444908 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.105473042 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.105495930 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.112339020 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.112401962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.112428904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.112441063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.112468004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.112484932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.119060993 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.119106054 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.119129896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.119143009 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.119178057 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.119204998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.124919891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.124968052 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.124994040 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.125011921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.125039101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.125058889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.132154942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.132200956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.132225037 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.132241011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.132273912 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.132292986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.138081074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.138125896 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.138154984 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.138168097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.138195038 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.138215065 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.214010954 CET	443	49913	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:49.286322117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.286386013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.286443949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.286474943 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.286499977 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.289911032 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.292895079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.292944908 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.292999983 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.293025017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.293047905 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.293885946 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.299757957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.299814939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.299865007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.299889088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.299916983 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.301883936 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.305680990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.305727959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.305777073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.305802107 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.305886030 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.309942007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.312455893 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.312504053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.312658072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.312658072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.312726974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.313898087 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.319142103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.319188118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.319350004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.319350958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.319421053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.319475889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.325488091 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.325529099 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.325596094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.325664997 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.325704098 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.326010942 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.332299948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.332340002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.332402945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.332473040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.332514048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.333885908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.412333012 CET	443	49913	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:49.415906906 CET	49913	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:49.416241884 CET	49913	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:49.417340040 CET	49932	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:49.417371035 CET	443	49932	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:49.417429924 CET	49932	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:49.417649031 CET	49932	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:49.417654991 CET	443	49932	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:49.478519917 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.478569984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.478725910 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.478760958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.478816986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.485337019 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.485380888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.485460043 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.485474110 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.485527039 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.485583067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.492023945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.492063046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.492127895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.492141008 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.492192030 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.492247105 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.497940063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.497984886 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.498095036 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.498107910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.498178005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.498244047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.504764080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.504808903 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.504906893 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.504920959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.504980087 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.505039930 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.511423111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.511466026 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.511497021 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.511511087 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.511543036 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.511563063 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.517827034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.517873049 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.517909050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.517927885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.517954111 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.517972946 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.524512053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.524555922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.524584055 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.524596930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.524625063 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.524643898 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.671011925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.671068907 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.671125889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.671152115 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.671179056 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.672198057 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.676928043 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.676949978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.676986933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.677006006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.677031994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.680710077 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.683820963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.683870077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.683896065 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.683908939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.683938026 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.683959007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.690922976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.690977097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.691008091 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.691021919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.691047907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.691066980 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.697329044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.697381973 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.697411060 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.697423935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.697449923 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.697468996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.704273939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.704345942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.704366922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.704380035 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.704426050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.704426050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.710261106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.710309029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.710349083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.710361958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.710391998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.710410118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.717356920 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.717398882 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.717464924 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.717478037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.717506886 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.720309019 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.862617970 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.862643957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.862699986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.862739086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.862772942 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.864558935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.869338989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.869354010 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.869437933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.869453907 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.869504929 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.876096010 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.876115084 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.876167059 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.876183987 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.876234055 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.882791996 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.882806063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.882864952 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.882865906 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.882883072 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.884831905 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.888766050 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.888780117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.888837099 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.888853073 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.888906002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.895476103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.895488977 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.895539045 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.895550966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.895582914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.896586895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.901889086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.901901960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.901973963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.901992083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.902017117 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.904061079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.908550024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.908565998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.908620119 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.908637047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:49.908660889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:49.912621975 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.055541039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.055565119 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.055656910 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.055658102 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.055723906 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.056277037 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.061410904 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.061425924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.061505079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.061521053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.061573982 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.068073988 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.068094015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.068159103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.068172932 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.068226099 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.074888945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.074903965 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.074958086 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.074970961 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.075022936 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.080913067 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.080930948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.080990076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.081003904 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.081059933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.087656975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.087673903 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.087739944 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.087753057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.087809086 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.093980074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.093997955 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.094096899 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.094110012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.094162941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.100640059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.100653887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.100713015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.100724936 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.100775957 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.246716976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.246743917 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.246828079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.246828079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.246896029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.246948957 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.253623962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.253638983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.253710985 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.253722906 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.253766060 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.260253906 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.260282040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.260324001 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.260360003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.260365963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.260406971 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.268026114 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.268040895 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.268096924 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.268105030 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.268147945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.273040056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.273055077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.273117065 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.273123980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.273165941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.279747963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.279797077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.279824018 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.279830933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.279863119 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.279876947 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.286201954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.286247015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.286279917 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.286287069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.286304951 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.286324978 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.295115948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.295130014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.295172930 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.295190096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.295213938 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.297885895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.439528942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.439603090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.439851046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.439917088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.439981937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.446141005 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.446194887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.446230888 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.446247101 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.446278095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.446300030 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.452130079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.452178955 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.452210903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.452231884 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.452265024 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.452284098 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.459531069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.459592104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.459603071 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.459619999 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.459661007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.459661961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.465857029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.465912104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.465931892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.465945959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.465976000 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.466006994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.471574068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.471622944 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.471643925 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.471681118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.471693039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.471745968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.478984118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.479037046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.479065895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.479079008 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.479109049 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.479131937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.484767914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.484812975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.484838963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.484850883 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.484880924 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.484899998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.632095098 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.632170916 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.632368088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.632369041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.632435083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.633883953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.637731075 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.637779951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.637809038 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.637825012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.637861967 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.641882896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.644371033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.644423962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.644450903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.644464970 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.644500971 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.644500971 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.651155949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.651211023 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.651253939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.651273012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.651300907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.653892040 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.657133102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.657181025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.657227039 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.657242060 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.657274961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.657296896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.664686918 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.664740086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.664788961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.664805889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.664833069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.665867090 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.670229912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.670293093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.670335054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.670347929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.670377016 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.673888922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.677001953 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.677047968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.677073956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.677087069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.677117109 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.677135944 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.823807001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.823885918 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.823913097 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.823982954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.824021101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.824044943 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.830399036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.830447912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.830476999 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.830492020 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.830530882 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.830530882 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.836383104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.836435080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.836458921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.836472034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.836502075 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.836524010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.843295097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.843368053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.843385935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.843399048 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.843432903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.843453884 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.850059032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.850105047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.850137949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.850151062 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.850178957 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.850244045 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.856587887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.856636047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.856690884 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.856713057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.856748104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.856770039 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.863086939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.863137007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.863166094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.863178968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.863209963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.863261938 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.868932962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.868978024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.869002104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.869014978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:50.869045973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:50.869065046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.015872002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.015928030 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.016036987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.016037941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.016086102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.017756939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.022517920 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.022567034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.022612095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.022627115 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.022658110 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.023339987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.029266119 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.029314995 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.029352903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.029366016 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.029392958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.031708956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.035178900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.035234928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.035286903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.035300016 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.035329103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.035372019 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.042129993 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.042180061 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.042207956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.042221069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.042260885 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.042260885 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.047600031 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.047661066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.047694921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.047708035 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.047739983 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.054109097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.054155111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.054203987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.054224968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.054260015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.060762882 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.060811043 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.060851097 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.060870886 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.060900927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.207602978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.207627058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.207669973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.207696915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.207726002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.211855888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.211865902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.211909056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.211925030 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.211961031 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.211992979 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.211992979 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.213732004 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.213798046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.213813066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.220685959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.220727921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.220762968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.220776081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.220802069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.220824003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.220843077 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.226557016 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.226599932 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.226632118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.226646900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.226676941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.233253956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.233360052 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.233381033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.233397007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.233429909 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.240273952 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.240314960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.240344048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.240358114 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.240386009 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.246387005 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.246437073 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.246462107 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.246474981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.246503115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.253256083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.253314972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.253345013 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.253360033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.253386974 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.399601936 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.399674892 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.399698973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.399775028 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.399816036 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.401422977 CET	443	49931	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:51.405750036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.405769110 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.405816078 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.405838966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.405842066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.405863047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.405874968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.405883074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.405914068 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.405915022 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.405935049 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.410121918 CET	49931	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:51.410176039 CET	443	49931	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:51.412324905 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.412378073 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.412395954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.412400007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.412414074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.412435055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.412436962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.412455082 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.412477970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.419117928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.419158936 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.419193983 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.419210911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.419244051 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.425056934 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.425106049 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.425139904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.425153017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.425184965 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.431794882 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.431837082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.431858063 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.431873083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.431915045 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.438261986 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.438309908 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.438343048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.438388109 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.438433886 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.444932938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.444973946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.444999933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.445014954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.445044994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.541311026 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.591423988 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.591454983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.591536999 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.591558933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.591581106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.591619015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.591641903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.597037077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.597059965 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.597100973 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.597117901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.597117901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.597141981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.597167969 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.603763103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.603809118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.603971958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.603996992 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.609853029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.609899044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.609973907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.609994888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.610035896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.616580963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.616626024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.616697073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.616710901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.616786003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.623230934 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.623272896 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.623471975 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.623488903 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.629579067 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.629623890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.629654884 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.629668951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.629699945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.636346102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.636389017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.636421919 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.636441946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.636468887 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.740080118 CET	443	49932	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:51.744597912 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.745326042 CET	49932	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:51.745413065 CET	443	49932	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:51.783127069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.783158064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.783211946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.783231974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.783252954 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.783252954 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.783302069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.783355951 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.783355951 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.784038067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.789201975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.789223909 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.789267063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.789284945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.789284945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.789309025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.789336920 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.789391041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.795887947 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.795932055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.795973063 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.795988083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.796017885 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.796039104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.801929951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.801987886 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.802018881 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.802031994 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.802061081 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.803885937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.808729887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.808777094 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.808811903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.808830976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.808860064 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.812228918 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.815340996 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.815386057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.815422058 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.815438986 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.815465927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.815484047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.821719885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.821767092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.821837902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.821851015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.821890116 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.821912050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.828413963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.828458071 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.828514099 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.828514099 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.828531981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.832546949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.921462059 CET	443	49931	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:51.921519041 CET	443	49931	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:51.921585083 CET	49931	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:51.922255993 CET	49931	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:51.923516989 CET	49943	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:51.923597097 CET	443	49943	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:51.923669100 CET	49943	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:51.923891068 CET	49943	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:51.923924923 CET	443	49943	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:51.975294113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.975392103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.975394011 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.975442886 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.975475073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.975501060 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.981133938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.981179953 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.981226921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.981245995 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.981272936 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.981359005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.987967014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.988017082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.988039970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.988051891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.988080978 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.988195896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.994590998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.994636059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.994669914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.994682074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:51.994710922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:51.994729042 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.000556946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.000612974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.000763893 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.000778913 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.000832081 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.007390976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.007435083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.007477045 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.007493973 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.007518053 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.009912968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.013705015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.013762951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.013850927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.013863087 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.013926029 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.013995886 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.020474911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.020525932 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.020561934 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.020580053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.020603895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.020620108 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.167984009 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.168046951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.168082952 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.168154001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.168191910 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.168215036 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.173274040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.173301935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.173461914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.173479080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.173537016 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.179954052 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.179997921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.180063963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.180078030 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.180128098 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.180166960 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.189490080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.189533949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.189621925 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.189635038 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.189687014 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.189742088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.193646908 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.193691969 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.193782091 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.193795919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.193835974 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.193897009 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.200406075 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.200452089 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.200495005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.200508118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.200539112 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.204325914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.206552029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.206594944 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.206633091 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.206650019 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.206677914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.206698895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.213386059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.213429928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.213469028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.213486910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.213573933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.213596106 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.264281034 CET	443	49932	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:52.264448881 CET	443	49932	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:52.264571905 CET	49932	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:52.265124083 CET	49932	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:52.265934944 CET	49944	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:52.266021967 CET	443	49944	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:52.266125917 CET	49944	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:52.266536951 CET	49944	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:52.266571999 CET	443	49944	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:52.359467983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.359519005 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.359710932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.359711885 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.359778881 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.360233068 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.365348101 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.365396976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.365550041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.365550041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.365617990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.365681887 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.372051954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.372095108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.372128963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.372148037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.372179985 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.372201920 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.378860950 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.378911018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.378942013 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.378957033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.378989935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.379010916 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.384695053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.384737968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.384819984 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.384819984 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.384836912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.384919882 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.391558886 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.391619921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.391660929 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.391675949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.391704082 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.391725063 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.397849083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.397898912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.397926092 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.397938967 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.397969961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.398009062 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.404484987 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.404506922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.404561996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.404575109 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.404603958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.404664040 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.551476955 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.551507950 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.551548004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.551570892 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.551587105 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.551912069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.558367968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.558398008 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.558444977 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.558463097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.558479071 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.559977055 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.564142942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.564171076 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.564199924 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.564213991 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.564229012 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.567930937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.572586060 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.572607040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.572649956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.572664976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.572680950 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.575959921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.595731020 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.595767021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.595813036 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.595833063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.595861912 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.596128941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.596219063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.596249104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.596287012 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.596304893 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.596328020 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.596862078 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.596889019 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.596918106 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.596944094 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.596973896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.596993923 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.597574949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.597603083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.597635984 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.597656012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.597680092 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.597698927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.743526936 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.743566990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.743676901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.743742943 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.743803024 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.743803978 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.750359058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.750386953 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.750442028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.750458002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.750492096 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.750513077 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.756244898 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.756267071 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.756310940 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.756325006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.756354094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.756396055 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.763061047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.763082981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.763127089 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.763147116 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.763175011 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.763195992 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.768758059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.768815041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.768819094 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.768857956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.768896103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.768915892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.774746895 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.774770021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.774806976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.774820089 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.774849892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.774869919 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.782013893 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.782053947 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.782094002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.782118082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.782144070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.782165051 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.787920952 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.787944078 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.787993908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.788006067 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.788038969 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.788058996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.793636084 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.793690920 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.793711901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.793724060 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.793757915 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.940671921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.940701962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.940864086 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.940865040 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.940936089 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.947367907 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.947380066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.947397947 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.947407007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.947436094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.947460890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.947494030 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.953186989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.953247070 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.953267097 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.953284025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.953315020 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.953344107 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.953344107 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.953355074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.953386068 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.959072113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.959096909 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.959173918 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.959173918 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.959192991 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.959256887 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.959990978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.960052967 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.966800928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.966821909 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.966861010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.966881990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.966911077 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.967009068 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.973201036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.973225117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.973275900 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.973289013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.973319054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.973336935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.979958057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.979985952 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.980036020 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.980048895 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.980076075 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.980159998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.985650063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.985698938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.985723972 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.985735893 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.985769987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.985991001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:52.986152887 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:52.986166954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.132863045 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.132893085 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.133047104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.133047104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.133119106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.139528036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.139537096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.139576912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.139585972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.139591932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.139631033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.139667034 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.139667034 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.145519972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.145565987 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.145581007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.145601988 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.145634890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.145657063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.145684004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.145684004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.145684004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.152177095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.152195930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.152245045 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.152261972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.152291059 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.152308941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.152327061 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.152375937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.158071041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.158121109 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.158148050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.158162117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.158190966 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.164477110 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.164496899 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.164556980 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.164571047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.164608955 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.171245098 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.171263933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.171312094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.171328068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.171365976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.177961111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.177979946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.178030968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.178045034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.178070068 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.244632959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.324640989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.324654102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.324698925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.324740887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.324820995 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.324853897 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.324903011 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.324964046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.330414057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.330435991 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.330544949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.330562115 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.333906889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.337970018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.337989092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.338093996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.338108063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.338191986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.343960047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.343981981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.344079971 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.344094038 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.345907927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.350816011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.350837946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.350934982 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.350949049 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.353908062 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.357096910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.357120037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.357217073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.357230902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.357902050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.363466978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.363487005 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.363584995 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.363599062 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.364612103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.369806051 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.369827032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.369920015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.369934082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.372441053 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.516112089 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.516144991 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.516190052 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.516215086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.516248941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.516272068 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.522864103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.522885084 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.522927999 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.522948980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.522978067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.523000002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.529598951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.529618025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.529679060 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.529696941 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.529726028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.529817104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.536325932 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.536345959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.536398888 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.536411047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.536432981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.536436081 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.536452055 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.536463976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.536515951 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.543103933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.543122053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.543163061 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.543175936 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.543205023 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.543226957 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.549619913 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.549639940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.549685001 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.549730062 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.549741983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.549791098 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.556257963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.556277037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.556319952 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.556332111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.556359053 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.556375980 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.703483105 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.703507900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.703607082 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.703607082 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.703674078 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.703785896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.709110022 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.709148884 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.709208965 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.709239006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.709269047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.709290981 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.715675116 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.715694904 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.715763092 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.715779066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.715878963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.722543001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.722563982 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.722620010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.722634077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.722661972 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.722682953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.728413105 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.728425980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.728588104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.728601933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.728840113 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.735142946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.735156059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.735224962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.735239983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.736820936 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.741622925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.741636992 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.741688013 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.741702080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.741727114 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.741745949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.748235941 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.748250008 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.748321056 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.748333931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.748404980 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.895713091 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.895765066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.895816088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.895886898 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.895945072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.895945072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.901544094 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.901629925 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.901659012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.901689053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.901725054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.901751995 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.908207893 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.908251047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.908308029 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.908323050 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.908354998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.908376932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.914027929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.914072037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.914118052 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.914130926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.914164066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.914185047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.920906067 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.920957088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.920996904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.921016932 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.921044111 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.921075106 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.927622080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.927670002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.927694082 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.927706003 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.927736044 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.927757025 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.933980942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.934029102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.934057951 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.934070110 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.934099913 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.934120893 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.940726995 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.940804005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.940804958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.940831900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:53.940865040 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:53.940888882 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.087799072 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.087856054 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.087912083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.087984085 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.088025093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.088049889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.093249083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.093308926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.093338013 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.093352079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.093384027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.093405962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.099901915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.099946976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.099991083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.100004911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.100035906 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.101866961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.107028008 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.107075930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.107115030 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.107131958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.107165098 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.107187033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.113373041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.113388062 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.113468885 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.113481998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.113537073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.119484901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.119502068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.119575024 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.119600058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.119649887 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.126003027 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.126020908 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.126086950 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.126102924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.126157045 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.132504940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.132519960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.132610083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.132623911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.132673979 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.142349005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.228739023 CET	443	49943	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:54.231535912 CET	49943	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:54.231558084 CET	443	49943	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:54.279789925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.279844046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.279978991 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.279978991 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.280045986 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.280103922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.286005974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.286052942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.286092997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.286117077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.286148071 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.286212921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.291995049 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.292041063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.292068005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.292081118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.292110920 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.292133093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.298635006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.298682928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.298712015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.298723936 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.298759937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.298780918 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.305519104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.305566072 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.305604935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.305623055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.305648088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.305670023 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.311369896 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.311414003 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.311444044 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.311455965 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.311486006 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.311486959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.311512947 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.318602085 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.318644047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.318691969 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.318711042 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.318734884 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.318736076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.318794012 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.324527979 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.324570894 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.324592113 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.324614048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.324629068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.324654102 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.324675083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.471621990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.471672058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.471719027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.471767902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.471801043 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.471824884 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.477917910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.477962971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.477998972 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.478013039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.478041887 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.478061914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.484442949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.484492064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.484517097 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.484534979 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.484564066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.484582901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.490423918 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.490470886 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.490500927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.490514040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.490552902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.490552902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.497237921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.497251034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.497328997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.497344971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.497395992 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.503817081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.503832102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.503886938 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.503906965 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.503933907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.504498005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.510783911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.510801077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.510848999 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.510867119 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.510893106 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.512624025 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.516963005 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.516978025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.517051935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.517066956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.517095089 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.517873049 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.657393932 CET	443	49944	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:54.659012079 CET	49944	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:54.659048080 CET	443	49944	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:54.663495064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.663512945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.663562059 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.663587093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.663614988 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.663634062 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.669951916 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.669965982 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.670013905 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.670037031 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.670063972 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.670183897 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.675786018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.675801992 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.675851107 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.675864935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.675895929 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.675916910 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.682584047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.682600021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.682661057 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.682679892 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.682708979 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.682729959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.689263105 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.689276934 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.689327002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.689344883 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.689373970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.689583063 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.695355892 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.695369959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.695416927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.695431948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.695461988 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.695482969 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.702454090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.702475071 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.702522993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.702545881 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.702572107 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.702593088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.707320929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.707398891 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.707406998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.707456112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.707487106 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.707505941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.714138031 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.714154959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.714217901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.714236021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.714265108 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.714283943 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.791177988 CET	443	49943	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:54.860869884 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.860889912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.860956907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.861023903 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.861068010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.861068010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.866935968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.866950989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.866997004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.867012024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.867100000 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.867121935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.872659922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.872724056 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.872736931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.872797012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.872848034 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.879355907 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.879369020 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.879421949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.879441977 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.879470110 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.885077000 CET	49943	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:54.885104895 CET	443	49943	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:54.885482073 CET	49943	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:54.885785103 CET	443	49943	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:54.885853052 CET	49943	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:54.886172056 CET	49958	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:54.886179924 CET	443	49958	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:54.886233091 CET	49958	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:54.886322021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.886338949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.886379957 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.886400938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.886425972 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.886444092 CET	49958	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:54.886456013 CET	443	49958	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:54.892517090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.892529964 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.892576933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.892596960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.892623901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.899188995 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.899200916 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.899285078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.899285078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.899302959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.905175924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.905189037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.905854940 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:54.905869961 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:54.947751999 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.051932096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.051980972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.052036047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.052109957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.052149057 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.052202940 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.058674097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.058690071 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.058821917 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.058836937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.058913946 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.065505028 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.065521955 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.065625906 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.065640926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.065742970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.071393967 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.071419001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.071501970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.071517944 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.071552038 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.071710110 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.078156948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.078171968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.078257084 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.078269958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.078346968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.084518909 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.084536076 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.084625006 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.084625006 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.084645033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.084760904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.090327978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.090378046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.090430021 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.090441942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.090486050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.091121912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.091245890 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.091259956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.097985983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.098005056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.098125935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.098140001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.241213083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.241266012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.241316080 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.241359949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.241441011 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.243206978 CET	443	49944	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:55.247813940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.247821093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.247862101 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.247883081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.247912884 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.247912884 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.247932911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.247967005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.248029947 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.254640102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.254648924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.254683971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.254729033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.254745007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.254780054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.255336046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.256669998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.256872892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.263639927 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.263655901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.263739109 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.263739109 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.263757944 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.270323038 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.270339966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.270385981 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.270405054 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.270432949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.276890039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.276905060 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.276988029 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.276988029 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.277005911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.283308029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.283327103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.283361912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.283402920 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.283418894 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.283462048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.289731979 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.289746046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.289840937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.289841890 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.289858103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.431920052 CET	49944	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:55.431920052 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.431942940 CET	443	49944	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:55.433197021 CET	49963	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:55.433202028 CET	49944	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:55.433213949 CET	443	49963	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:55.433301926 CET	49963	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:55.433362961 CET	443	49944	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:55.433480024 CET	49944	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:55.433650017 CET	49963	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:55.433661938 CET	443	49963	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:55.436116934 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.436125994 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.436172962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.436208963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.436216116 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.436249018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.436279058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.436311007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.436311960 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.436311960 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.437344074 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.442775011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.442783117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.442817926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.442848921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.442851067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.442881107 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.442915916 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.442915916 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.443197966 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.449645996 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.449652910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.449693918 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.449747086 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.449767113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.449793100 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.450277090 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.455660105 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.455674887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.455756903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.455756903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.455774069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.455965996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.462232113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.462244987 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.462325096 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.462325096 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.462342024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.462675095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.468674898 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.468688011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.468822956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.468837023 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.469008923 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.474591017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.474637985 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.474683046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.474694967 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.474728107 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.481194973 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.481208086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.481287003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.481287003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.481302977 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.541349888 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.628019094 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.628034115 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.628101110 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.628110886 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.628135920 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.628180027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.628180027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.628197908 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.628237963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.628416061 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.633970976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.633991957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.634124041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.634140015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.636029959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.640723944 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.640746117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.640837908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.640837908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.640856028 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.641019106 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.641591072 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.641731024 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.647392988 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.647448063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.647507906 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.647520065 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.647562981 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.654194117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.654216051 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.654262066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.654273987 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.654305935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.660547972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.660567045 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.660645962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.660645962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.660664082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.666467905 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.666488886 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.666569948 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.666584015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.666621923 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.673331022 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.673358917 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.673437119 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.673451900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.673485041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.744522095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.819988966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.820002079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.820050001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.820084095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.820122004 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.820139885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.820219040 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.820219994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.820219994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.820219994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.820518970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.826898098 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.826909065 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.826967001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.827012062 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.827042103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.827081919 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.827249050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.832853079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.832876921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.832973003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.832988024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.833024979 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.833177090 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.839476109 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.839498043 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.839540958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.839553118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.839592934 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.839637995 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.846149921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.846170902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.846235037 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.846235037 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.846251011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.846466064 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.852473974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.852497101 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.852564096 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.852564096 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.852577925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.852942944 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.859746933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.859766006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.859839916 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.859839916 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.859853983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.860131979 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.865283966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.865303993 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.865345955 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.865358114 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:55.865391970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:55.865458965 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.011945963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.011967897 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.012032986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.012104988 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.012151003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.012326956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.018759012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.018779993 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.018825054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.018841028 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.018871069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.018913031 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.025547028 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.025568962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.025614977 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.025615931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.025631905 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.025655985 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.025684118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.032336950 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.032356024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.032402039 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.032416105 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.032449007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.039002895 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.039027929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.039066076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.039087057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.039112091 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.045279026 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.045301914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.045350075 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.045367002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.045394897 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.052054882 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.052083015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.052114010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.052134991 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.052164078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.057960033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.057980061 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.058022976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.058037043 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.058067083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.135147095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.208703995 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.208714962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.208787918 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.208841085 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.208878040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.208913088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.208946943 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.209017992 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.209017992 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.214607954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.214617014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.214667082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.214719057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.214802027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.214802027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.214869022 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.214951038 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.221405029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.221426010 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.221478939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.221502066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.221529961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.223280907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.228060961 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.228080988 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.228125095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.228140116 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.228167057 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.228187084 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.234370947 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.234390974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.234435081 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.234446049 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.234473944 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.234493017 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.241266012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.241287947 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.241333008 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.241344929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.241372108 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.242141962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.247185946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.247206926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.247277975 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.247291088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.247347116 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.253925085 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.253945112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.253989935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.254004002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.254034996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.255554914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.400676012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.400698900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.400871038 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.400871038 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.400942087 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.401901960 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.406661034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.406683922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.406728983 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.406744957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.406774998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.407355070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.413403988 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.413424015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.413465023 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.413479090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.413506031 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.413553953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.420073032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.420090914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.420133114 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.420146942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.420176983 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.420916080 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.426541090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.426559925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.426614046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.426628113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.426657915 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.426680088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.433219910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.433238029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.433285952 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.433299065 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.433329105 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.433355093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.439318895 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.439337969 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.439377069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.439400911 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.439414024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.439466953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.445921898 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.445941925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.445986986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.446000099 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.446029902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.446089983 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.592715025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.592746973 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.592911959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.592911959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.592982054 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.593044043 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.598514080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.598540068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.598582983 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.598599911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.598634005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.598651886 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.605540037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.605566025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.605602980 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.605617046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.605645895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.605667114 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.612061024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.612082958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.612121105 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.612134933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.612169981 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.612169981 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.613102913 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.613153934 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.617423058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.617486000 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.617501974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.617547989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.617579937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.621247053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.621288061 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.621313095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.621330023 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.621387005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.625147104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.625202894 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.625211954 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.625226974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.625386953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.633212090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.633240938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.633280993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.633296967 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.633333921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.633479118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.637778997 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.637803078 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.637847900 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.637861013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.637890100 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.637907028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.779726028 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.779825926 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.785742044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.785793066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.785825968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.785865068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.785959959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.786010981 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.791718006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.791764975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.791824102 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.791824102 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.791843891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.791909933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.798397064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.798441887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.798472881 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.798486948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.798515081 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.798532009 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.804289103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.804337025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.804369926 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.804383039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.804413080 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.810698032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.810745001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.810775042 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.810790062 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.810817003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.817370892 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.817414045 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.817449093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.817471981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.817497015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.818269014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.818331003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.818346024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.819461107 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.819519997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.819533110 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.819580078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.826212883 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.826318979 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.826344013 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.826356888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.826385021 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.826405048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.829981089 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.830056906 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.830079079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.830090046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.948996067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.971946001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.971970081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.972059011 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.972131014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.972176075 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.978785038 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.978795052 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.978854895 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.978866100 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.978910923 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.978939056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.978982925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.979007006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.979041100 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.979041100 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.979041100 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.985374928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.985420942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.985451937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.985461950 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.985486984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.985517025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.985547066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.985547066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.985548019 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.991457939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.991477966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.991540909 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.991564035 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.991667986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.995075941 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:56.995161057 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:56.995174885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.001509905 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.001538992 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.001621962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.001621962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.001663923 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.006587029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.006644964 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.006691933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.006711960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.006740093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.006782055 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.013057947 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.013077021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.013192892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.013206959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.013310909 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.019902945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.019922972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.020199060 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.020212889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.020504951 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.020832062 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.021018028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.166831017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.166855097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.166935921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.166937113 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.167004108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.167095900 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.171576023 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.171652079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.171704054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.171719074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.171751022 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.178323984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.178344011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.178420067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.178420067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.178438902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.185105085 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.185123920 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.185197115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.185197115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.185215950 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.186045885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.186120987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.186135054 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.192028999 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.192051888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.192133904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.192133904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.192168951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.193504095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.193602085 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.193618059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.200164080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.200186968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.200287104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.200287104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.200303078 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.206146002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.206170082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.206290007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.206290960 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.206337929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.207721949 CET	443	49958	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:57.207870960 CET	49958	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:57.209752083 CET	49958	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:57.209758997 CET	443	49958	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:57.210417032 CET	443	49958	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:57.211172104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.211252928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.211287022 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.211304903 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.211364985 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.211410046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.211596966 CET	49958	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:57.255327940 CET	443	49958	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:57.357749939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.357785940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.357877970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.357877970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.357904911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.358889103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.364568949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.364592075 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.364675045 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.364675045 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.364691973 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.364942074 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.370506048 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.370527029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.370620966 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.370620966 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.370663881 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.370780945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.376190901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.376256943 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.376310110 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.376323938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.376368046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.383841991 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.383862972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.383923054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.383940935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.383985996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.384030104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.390180111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.390228987 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.390271902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.390284061 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.390316963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.390346050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.397063017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.397083044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.397146940 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.397162914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.397195101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.398930073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.402874947 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.402925014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.402967930 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.402988911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.403016090 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.403126001 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.448786974 CET	49958	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:57.449091911 CET	443	49958	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:57.449193001 CET	49958	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:57.449666977 CET	49970	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:57.449690104 CET	443	49970	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:57.450599909 CET	49970	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:57.450922966 CET	49970	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:57.450936079 CET	443	49970	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:57.550875902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.550906897 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.550976038 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.550976038 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.550992966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.551070929 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.557459116 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.557481050 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.557557106 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.557558060 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.557573080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.558017015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.564331055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.564361095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.564435959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.564455032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.564483881 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.564534903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.570291042 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.570317984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.570372105 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.570385933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.570441008 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.570441008 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.576153994 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.576189041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.576277018 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.576291084 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.576334953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.576419115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.582617998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.582679987 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.582724094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.582745075 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.582767963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.582935095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.589914083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.589958906 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.590001106 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.590014935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.590053082 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.590121984 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.597065926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.597115993 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.597158909 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.597172022 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.597208023 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.597249031 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.742387056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.742446899 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.742495060 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.742511034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.742549896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.742568016 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.749129057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.749174118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.749219894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.749268055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.749305010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.749919891 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.751342058 CET	443	49963	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:57.751954079 CET	49963	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:57.753460884 CET	49963	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:57.753469944 CET	443	49963	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:57.754242897 CET	443	49963	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:57.755085945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.755134106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.755182028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.755202055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.755235910 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.755278111 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.755494118 CET	49963	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:57.761954069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.762000084 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.762044907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.762061119 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.762089968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.762247086 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.768507004 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.768537998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.768614054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.768614054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.768631935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.768698931 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.774832010 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.774852037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.774950027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.774950027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.774966002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.775403976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.781588078 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.781606913 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.781702995 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.781716108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.781758070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.781805992 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.787857056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.787888050 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.787997007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.787997007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.788012981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.788072109 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.799329042 CET	443	49963	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:57.934537888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.934566021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.934727907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.934729099 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.934796095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.934883118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.941147089 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.941170931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.941210032 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.941226006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.941256046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.941279888 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.947099924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.947120905 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.947171926 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.947191000 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.947215080 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.948965073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.953870058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.953891039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.953943014 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.953960896 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.953989029 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.956007004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.960608959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.960629940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.960676908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.960695028 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.960720062 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.964082003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.967005014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.967025995 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.967065096 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.967082024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.967106104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.968322992 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.973741055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.973764896 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.973803997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.973822117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.973846912 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.975888968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.979685068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.979705095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.979749918 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.979767084 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:57.979790926 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:57.979896069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.127105951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.127137899 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.127207041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.127207041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.127269983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.128173113 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.132987022 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.133011103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.133126974 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.133143902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.133224964 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.138825893 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.138878107 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.138956070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.138989925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.139034986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.146645069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.146665096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.146770000 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.146789074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.153822899 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.153844118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.153897047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.153918982 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.153947115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.153965950 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.160784960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.160804033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.160964012 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.160984039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.161061049 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.166728020 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.166749954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.166863918 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.166877985 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.166949987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.173234940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.173266888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.173351049 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.173363924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.173433065 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.173484087 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.269794941 CET	443	49963	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:58.269957066 CET	443	49963	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:58.270148039 CET	49963	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:58.270598888 CET	49963	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:58.271593094 CET	49974	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:58.271611929 CET	443	49974	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:58.271668911 CET	49974	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:58.271972895 CET	49974	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:58.271985054 CET	443	49974	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:58.318725109 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.318754911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.318805933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.318855047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.318892002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.318921089 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.325485945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.325506926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.325547934 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.325562954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.325592041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.325612068 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.331486940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.331506014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.331549883 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.331562042 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.331593990 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.331614971 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.337266922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.337331057 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.337344885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.337395906 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.337424040 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.338128090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.338181019 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.338195086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.344928980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.344954014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.344995022 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.345011950 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.345041037 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.351253986 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.351272106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.351311922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.351344109 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.351382971 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.358081102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.358103037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.358140945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.358155012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.358186007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.364042997 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.364061117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.364104033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.364125013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.364149094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.447650909 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.495414972 CET	49970	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:58.496655941 CET	49975	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:58.496741056 CET	443	49975	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:58.496823072 CET	49975	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:58.497076035 CET	49975	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:58.497113943 CET	443	49975	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:58.510468960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.510478973 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.510536909 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.510562897 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.510562897 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.510576963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.510633945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.510668039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.510708094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.510708094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.510708094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.510745049 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.517339945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.517349958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.517390966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.517411947 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.517427921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.517458916 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.517496109 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.523860931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.523901939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.523937941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.523952007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.523977995 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.524024963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.530823946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.530847073 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.530886889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.530899048 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.530925035 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.530946016 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.536845922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.536864996 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.536900997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.536912918 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.536942959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.536962986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.542907000 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.542927980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.542964935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.542977095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.543005943 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.543040991 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.543328047 CET	443	49970	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:58.549793005 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.549813032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.549855947 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.549868107 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.549896002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.549917936 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.556449890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.556471109 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.556510925 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.556521893 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.556550980 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.556765079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.703495026 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.703522921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.703576088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.703602076 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.703625917 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.703644037 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.710164070 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.710186005 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.710356951 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.710356951 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.710423946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.710484028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.716772079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.716809988 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.716846943 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.716864109 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.716893911 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.716942072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.722750902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.722771883 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.722814083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.722826958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.722862005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.722883940 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.729578018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.729609966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.729645014 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.729659081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.729688883 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.729711056 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.735940933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.735963106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.736002922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.736016035 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.736047983 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.736090899 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.742737055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.742763996 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.742826939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.742826939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.742841959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.742970943 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.749381065 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.749399900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.749438047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.749445915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.749473095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.749484062 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.895260096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.895292044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.895456076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.895456076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.895530939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.895697117 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.902959108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.902977943 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.903069973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.903088093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.903127909 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.903333902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.908726931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.908742905 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.908849955 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.908864975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.908951044 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.915713072 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.915730953 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.915860891 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.915874958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.915970087 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.921674013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.921689034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.922585964 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.922599077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.922846079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.928185940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.928200960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.928459883 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.928472996 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.928610086 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.934597015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.934609890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.934689045 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.934701920 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.934782982 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.942065001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.942080975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.942150116 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:58.942162991 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:58.942281961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.087367058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.087394953 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.087578058 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.087650061 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.087699890 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.087768078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.094036102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.094058037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.094101906 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.094124079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.094151974 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.094235897 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.100919962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.100939989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.101035118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.101036072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.101052046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.101242065 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.107446909 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.107466936 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.107567072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.107567072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.107582092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.107626915 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.113569021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.113589048 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.113681078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.113693953 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.113734961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.113776922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.120136023 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.120157957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.120269060 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.120284081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.120353937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.126539946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.126560926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.126656055 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.126656055 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.126671076 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.126954079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.133235931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.133255959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.133351088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.133351088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.133366108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.133521080 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.279808044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.279839993 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.280030966 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.280030966 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.280097008 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.280282974 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.286552906 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.286573887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.286787033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.286803961 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.286916018 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.292433023 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.292454004 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.292547941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.292563915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.292701960 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.299447060 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.299468040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.299657106 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.299671888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.300399065 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.307001114 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.307022095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.307154894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.307168007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.307394981 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.311959982 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.311980963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.312067986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.312067986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.312083960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.312339067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.319331884 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.319358110 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.319446087 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.319447041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.319463015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.319551945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.325381994 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.325403929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.325525999 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.325539112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.325613976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.686043978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.686072111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.686321974 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.686322927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.686388969 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.686532974 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.686635971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.686657906 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.686733961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.686733961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.686752081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.686846018 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.687596083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.687625885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.687661886 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.687675953 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.687716007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.687922955 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.688508987 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.688529015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.688607931 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.688608885 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.688621998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.688652039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.688684940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.688692093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.688704014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.688734055 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.688783884 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.688785076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.689394951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.689416885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.689495087 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.689495087 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.689510107 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.689629078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.690314054 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.690334082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.690409899 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.690409899 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.690427065 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.690785885 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.691288948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.691309929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.691524029 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.691540956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.691776037 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.692220926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.692240953 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.692285061 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.692297935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.692334890 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.692898989 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.693073034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.693120003 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.693155050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.693166971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.693198919 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.693263054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.694005013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.694048882 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.694092035 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.694103956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.694130898 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.694389105 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.694413900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.694431067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.694448948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.694474936 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.694494009 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.694539070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.695291042 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.695322990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.695372105 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.695385933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.695426941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.695513010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.696415901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.696434975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.696500063 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.696512938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.696546078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.696580887 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.702871084 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.702889919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.703025103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.703041077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.703139067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.709574938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.709602118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.709707975 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.709707975 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.709726095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.710030079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.777792931 CET	443	49970	13.232.67.198	192.168.2.4
Dec 12, 2024 11:16:59.777904034 CET	49970	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:59.777904034 CET	49970	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:16:59.855638027 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.855664015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.855783939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.855856895 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.855905056 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.856175900 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.860440016 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.860460043 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.860539913 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.860539913 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.860558033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.860646009 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.866074085 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.866094112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.866182089 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.866182089 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.866198063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.866286993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.871531010 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.871552944 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.871656895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.871656895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.871675968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.871736050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.877182007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.877201080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.877274990 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.877275944 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.877296925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.877424002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.882044077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.882064104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.882142067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.882143021 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.882159948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.882531881 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.887299061 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.887366056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.887414932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.887428999 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.887461901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.887533903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.888097048 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.888185978 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.894232035 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.894259930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.894371986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.894371986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:16:59.894387007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:16:59.947633982 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.048139095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.048152924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.048238039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.048269987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.048296928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.048345089 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.048384905 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.048408031 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.053587914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.053611040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.053661108 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.053680897 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.053708076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.056121111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.056191921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.056206942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.056262970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.056792974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.056854963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.062405109 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.062438011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.062591076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.062603951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.062663078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.067356110 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.067374945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.067423105 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.067449093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.067477942 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.068432093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.072916985 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.072937012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.073048115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.073064089 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.073153973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.078576088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.078608036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.078696012 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.078710079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.078792095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.078851938 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.083729029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.083754063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.083797932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.083816051 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.083842039 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.084430933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.238578081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.238626003 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.239013910 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.239079952 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.239182949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.244012117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.244057894 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.244137049 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.244153023 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.244218111 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.244265079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.249795914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.249851942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.249892950 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.249907017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.249938965 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.249963045 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.254528046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.254576921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.254610062 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.254636049 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.254663944 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.254683971 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.260077000 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.260128975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.260166883 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.260179996 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.260210037 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.260355949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.265590906 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.265634060 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.265674114 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.265691996 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.265719891 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.265764952 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.270281076 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.270349026 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.270354033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.270416975 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.270416975 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.270431042 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.270793915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.270848989 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.270864010 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.276360989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.276387930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.276428938 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.276443958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.276474953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.431767941 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.431801081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.431967020 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.431967020 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.432040930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.436664104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.436672926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.436726093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.436734915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.436786890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.436815023 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.436870098 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.436909914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.436913967 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.436913967 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.436913967 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.436913967 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.436913967 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.442408085 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.442418098 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.442455053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.442468882 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.442490101 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.442523003 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.442553043 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.442553043 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.442553997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.442567110 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.442580938 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.442598104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.442686081 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.447772026 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.447782040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.447824001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.447844028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.447859049 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.447887897 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.447931051 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.452534914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.452560902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.452608109 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.452624083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.452662945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.452662945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.458276033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.458297968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.458348989 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.458363056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.458395004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.458436012 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.463382959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.463407993 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.463449001 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.463462114 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.463495970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.463593006 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.468357086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.468380928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.468417883 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.468429089 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.468460083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.468540907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.580533981 CET	443	49974	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:00.623224974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.623255014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.623344898 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.623397112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.623425961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.624193907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.625811100 CET	49974	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:00.625835896 CET	443	49974	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:00.628066063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.628086090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.628154039 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.628171921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.628209114 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.629880905 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.633843899 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.633862972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.633908033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.633920908 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.633950949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.634537935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.638622046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.638647079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.638706923 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.638719082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.638752937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.638778925 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.644203901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.644229889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.644280910 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.644299030 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.644325018 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.645886898 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.652731895 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.652755976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.652858019 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.652872086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.652934074 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.656263113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.656316042 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.656341076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.656352043 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.656380892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.657072067 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.657866955 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.657880068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.662929058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.662959099 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.663002968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.663032055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.663059950 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.744414091 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.804080009 CET	443	49975	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:00.815383911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.815395117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.815468073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.815500975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.815529108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.815553904 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.815579891 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.815579891 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.815613985 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.820195913 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.820205927 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.820275068 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.820281029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.820343971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.820364952 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.820389032 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.821854115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.825078011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.825130939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.825149059 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.825160980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.825192928 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.825668097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.829854965 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.829869032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.830676079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.830699921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.830740929 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.830768108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.830792904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.836287975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.836307049 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.836348057 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.836364985 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.836395979 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.841742992 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.841766119 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.841806889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.841830015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.841856956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.846240044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.846257925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.846302986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.846318960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.846349001 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.846470118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.847556114 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.847609997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.852588892 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.852608919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.852653980 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.852665901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:00.852694988 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.852797031 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:00.854300022 CET	49975	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:00.854357958 CET	443	49975	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:01.007512093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.007544041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.007644892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.007644892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.007711887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.007997036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.008553028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.008570910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.008690119 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.013190985 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.013211012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.013847113 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.013860941 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.017209053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.017256975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.017302036 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.017317057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.017357111 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.017721891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.017962933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.017976046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.023453951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.023474932 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.023514032 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.023533106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.023571968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.028247118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.028264999 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.028350115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.028364897 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.028405905 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.033951998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.033972025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.034058094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.034058094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.034075975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.038861036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.038877964 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.038939953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.038953066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.038990974 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.039138079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.040491104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.040503979 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.040621996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.044634104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.044672966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.044720888 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.044733047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.044765949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.045103073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.179951906 CET	443	49974	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:01.180134058 CET	443	49974	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:01.180303097 CET	49974	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:01.181592941 CET	49974	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:01.181613922 CET	49987	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:01.181704998 CET	443	49987	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:01.181889057 CET	49987	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:01.182260990 CET	49987	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:01.182293892 CET	443	49987	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:01.204997063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.205024004 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.205137014 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.205137014 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.205183029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.205275059 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.209724903 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.209743977 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.209847927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.209847927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.209863901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.209954977 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.214565992 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.214606047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.214652061 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.214663982 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.214698076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.215439081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.215717077 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.215730906 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.220896006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.220921993 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.220962048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.220978022 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.221019030 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.226567030 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.226584911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.226664066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.226664066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.226681948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.231694937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.231719971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.231803894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.231803894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.231820107 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.236792088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.236809969 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.236855984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.236891985 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.236907959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.236939907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.242204905 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.242227077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.242305994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.242305994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.242321968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.365973949 CET	443	49975	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:01.366050005 CET	443	49975	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:01.366271019 CET	49975	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:01.366496086 CET	49975	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:01.369839907 CET	49988	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:01.369868994 CET	443	49988	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:01.370035887 CET	49988	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:01.370337009 CET	49988	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:01.370354891 CET	443	49988	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:01.397171021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.397191048 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.397403955 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.397403955 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.397475958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.402347088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.402355909 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.402378082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.402386904 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.402393103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.402403116 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.402431965 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.402456045 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.402508020 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.407118082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.407128096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.407152891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.407172918 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.407186031 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.407192945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.407212019 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.407238960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.407265902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.407265902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.407265902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.407301903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.407913923 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.408011913 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.412906885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.412915945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.412941933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.412972927 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.412983894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.413002014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.413029909 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.413096905 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.418425083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.418445110 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.418536901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.418536901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.418551922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.418632984 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.423901081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.423919916 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.424014091 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.424015045 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.424032927 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.424319029 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.429195881 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.429215908 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.429296970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.429296970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.429312944 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.429426908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.430080891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.430310965 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.435684919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.435703039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.435812950 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.435827017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.541477919 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.589838982 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.589876890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.589900017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.589911938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.589937925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.589953899 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.589987993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.589987993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.589987993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.590070009 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.595333099 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.595343113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.595372915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.595386028 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.595416069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.595505953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.595532894 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.595650911 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.599258900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.599270105 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.599291086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.599334955 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.599350929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.599385977 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.599415064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.599752903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.599769115 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.604929924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.604948997 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.605043888 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.605043888 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.605053902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.610460997 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.610488892 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.610531092 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.610542059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.610570908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.615761995 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.615781069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.615885973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.615885973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.615896940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.620620012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.620639086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.620729923 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.620729923 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.620739937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.620817900 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.621292114 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.621397972 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.626955986 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.626983881 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.627064943 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.627064943 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.627074003 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.627191067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.781166077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.781194925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.781390905 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.781435013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.781687975 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.786705971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.786726952 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.786820889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.786822081 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.786839008 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.787358046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.791585922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.791625023 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.791666985 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.791673899 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.791687012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.791718006 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.792073011 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.797271013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.797291994 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.797363043 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.797363043 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.797378063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.797476053 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.802712917 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.802742004 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.802844048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.802844048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.802859068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.802923918 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.807981968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.808005095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.808048010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.808060884 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.808098078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.808182001 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.813600063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.813615084 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.813692093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.813692093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.813707113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.813766956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.818392038 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.818408012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.818476915 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.818476915 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.818490982 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.818591118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.973397017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.973417044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.973598003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.973598003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.973666906 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.973731041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.978583097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.978599072 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.978653908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.978671074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.978703976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.978857994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.984025002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.984039068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.984097004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.984110117 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.984142065 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.984163046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.989743948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.989757061 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.989814997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.989830017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.989887953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.994545937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.994560003 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.994611979 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.994625092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.994654894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.995006084 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:01.999918938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.999932051 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:01.999989033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.000003099 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.000061035 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.005338907 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.005352974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.005398989 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.005412102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.005441904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.005744934 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.010832071 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.010844946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.010901928 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.010915995 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.010970116 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.165555954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.165572882 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.165750980 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.165816069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.165880919 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.170744896 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.170763969 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.170806885 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.170824051 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.170861006 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.170881033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.176392078 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.176407099 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.176461935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.176479101 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.176615953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.181255102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.181294918 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.181318998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.181332111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.181361914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.181391954 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.186785936 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.186800957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.186857939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.186872959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.186923981 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.191997051 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.192023993 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.192053080 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.192065954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.192095041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.192116022 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.197596073 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.197613001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.197666883 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.197679996 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.197731972 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.203259945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.203273058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.203329086 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.203344107 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.203414917 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.357775927 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.357795000 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.357955933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.357956886 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.358022928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.358074903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.363001108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.363015890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.363081932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.363101959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.363215923 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.364387989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.364449978 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.368257046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.368294954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.368330002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.368343115 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.368376970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.373773098 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.373789072 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.373867035 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.373883963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.378742933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.378762007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.378838062 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.378855944 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.384608030 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.384625912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.384697914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.384711027 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.389563084 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.389580011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.389653921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.389668941 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.395296097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.395318985 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.395374060 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.395387888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.395421982 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.447676897 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.549370050 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.549377918 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.549413919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.549427032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.549557924 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.549557924 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.549623966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.549715996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.554871082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.554877996 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.554919958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.554941893 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.554958105 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.554986954 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.555015087 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.560447931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.560461998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.560523987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.560538054 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.560600042 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.566704035 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.566718102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.566780090 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.566792965 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.566843987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.572418928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.572432041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.572489977 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.572503090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.572540998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.572559118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.577632904 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.577675104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.577704906 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.577717066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.577744961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.577760935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.583101988 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.583120108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.583178997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.583193064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.583228111 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.584146976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.588562012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.588577032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.588654041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.588676929 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.588689089 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.588742018 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.741549015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.741578102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.741749048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.741750002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.741816044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.741873980 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.747143984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.747174978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.747217894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.747234106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.747265100 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.747287989 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.752538919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.752562046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.752608061 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.752621889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.752652884 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.752674103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.757504940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.757522106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.757574081 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.757586956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.757617950 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.757639885 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.762960911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.762979031 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.763029099 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.763061047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.763072968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.763137102 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.768265009 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.768286943 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.768336058 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.768348932 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.768379927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.768403053 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.773026943 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.773080111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.773087978 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.773123026 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.773154020 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.773766041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.773828030 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.773842096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.779397964 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.779428005 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.779463053 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.779476881 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.779506922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.933990002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.934015036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.934323072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.934323072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.934396029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.938977957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.938987970 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.939028978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.939064980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.939093113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.939111948 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.939133883 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.939173937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.939173937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.944276094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.944470882 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.944479942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.944506884 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.944516897 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.944544077 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.944549084 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.944567919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.944607973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.947629929 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.949917078 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.949927092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.949950933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.949961901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.949989080 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.950006962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.950037003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.954885006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.954932928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.954962969 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.954974890 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.954997063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.955018044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.955049038 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.955049038 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.955049992 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.960839033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.960871935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.960966110 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.960966110 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.960984945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.965684891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.965712070 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.965759993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.965773106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.965812922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.971401930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.971421003 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.971478939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:02.971493006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:02.971529007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.125829935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.125854969 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.126029015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.126029015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.126065016 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.131349087 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.131364107 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.131391048 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.131398916 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.131406069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.131431103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.131433010 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.131462097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.131469965 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.131494045 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.136795998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.136806965 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.136842012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.136873960 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.136876106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.136902094 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.136929035 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.136945963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.136970043 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.136976957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.137088060 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.142504930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.142513990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.142554045 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.142563105 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.142591000 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.142591000 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.142602921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.142618895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.147250891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.147279978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.147326946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.147353888 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.147375107 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.147417068 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.153158903 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.153181076 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.153220892 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.153259039 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.153276920 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.153315067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.158063889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.158088923 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.158127069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.158140898 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.158171892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.163650990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.163672924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.163752079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.163752079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.163762093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.244420052 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.317821980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.317837000 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.317909002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.317961931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.317967892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.318005085 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.318022966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.318039894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.318052053 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.318130016 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.323381901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.323391914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.323431969 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.323462963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.323472977 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.323487043 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.323517084 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.323595047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.328850985 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.328860044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.328898907 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.328937054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.328946114 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.328977108 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.329050064 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.333933115 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.333955050 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.334072113 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.334072113 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.334080935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.334224939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.339447975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.339468956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.339544058 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.339544058 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.339554071 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.339670897 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.344918966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.344942093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.345024109 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.345024109 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.345032930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.345148087 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.350235939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.350289106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.350328922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.350341082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.350383043 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.350863934 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.355705976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.355746984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.355828047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.355829000 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.355843067 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.355911970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.488313913 CET	443	49987	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:03.496047974 CET	49987	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:03.496067047 CET	443	49987	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:03.510847092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.510874033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.510993958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.510993958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.511037111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.511364937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.515641928 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.515664101 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.515778065 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.515778065 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.515793085 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.516052008 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.521195889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.521218061 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.521295071 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.521310091 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.521595955 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.526683092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.526730061 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.526770115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.526782990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.526818991 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.526992083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.531550884 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.531574965 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.531708956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.531722069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.532018900 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.537796974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.537823915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.537950039 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.537950039 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.537969112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.538038015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.542402983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.542448044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.542490005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.542501926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.542552948 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.542591095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.548120975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.548154116 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.548264027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.548264027 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.548279047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.548769951 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.678262949 CET	443	49988	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:03.702948093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.702972889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.703335047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.703399897 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.703563929 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.708599091 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.708621979 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.708877087 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.708892107 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.709050894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.713396072 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.713418007 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.713535070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.713548899 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.713639021 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.718930006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.718950033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.719021082 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.719034910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.719110966 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.719111919 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.724512100 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.724531889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.724623919 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.724637032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.724715948 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.729762077 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.729784012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.729872942 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.729872942 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.729901075 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.729979992 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.735341072 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.735363960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.735457897 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.735471010 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.735560894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.740169048 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.740190029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.740284920 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.740284920 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.740300894 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.740375996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.744577885 CET	49988	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:03.895279884 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.895299911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.895651102 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.895678043 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.895801067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.900177002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.900201082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.900352001 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.900378942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.900480032 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.905708075 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.905725002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.905858994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.905874014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.905967951 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.911206961 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.911222935 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.911346912 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.911360025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.911458015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.916815996 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.916832924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.916943073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.916956902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.917031050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.922040939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.922055960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.922148943 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.922162056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.922230959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.926971912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.926985979 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.927094936 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.927108049 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.927182913 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.932564974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.932584047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.932733059 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:03.932744980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:03.932853937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.007399082 CET	443	49987	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:04.007462025 CET	443	49987	13.232.67.198	192.168.2.4
Dec 12, 2024 11:17:04.007613897 CET	49987	443	192.168.2.4	13.232.67.198
Dec 12, 2024 11:17:04.087274075 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.087301970 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.087517023 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.087532997 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.087619066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.092834949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.092849970 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.092982054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.092989922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.093064070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.098089933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.098104954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.098268986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.098277092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.098356962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.103239059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.103254080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.103380919 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.103389025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.103461981 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.108859062 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.108874083 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.108977079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.108985901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.109065056 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.114069939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.114088058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.114183903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.114192009 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.114280939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.119688988 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.119708061 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.119767904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.119776964 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.119826078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.124576092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.124592066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.124659061 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.124666929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.124727011 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.279128075 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.279148102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.279220104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.279256105 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.279278040 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.279320955 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.284778118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.284796000 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.284861088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.284893036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.284961939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.291294098 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.291311026 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.291352987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.291361094 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.291376114 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.291419029 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.295552969 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.295567989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.295622110 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.295630932 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.295674086 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.301752090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.301768064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.301840067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.301853895 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.301908016 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.305963039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.305990934 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.306029081 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.306041002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.306078911 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.306099892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.311642885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.311659098 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.311708927 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.311722040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.311759949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.311778069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.317156076 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.317178965 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.317245007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.317253113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.317301035 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.472172976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.472213984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.472358942 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.472373962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.472505093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.477628946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.477658987 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.477696896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.477705956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.477757931 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.477782965 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.483017921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.483033895 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.483092070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.483100891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.483161926 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.488070965 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.488085032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.488143921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.488152981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.488197088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.493793964 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.493809938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.493865013 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.493872881 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.493918896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.498414040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.498466015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.498497009 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.498502970 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.498524904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.498552084 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.503870964 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.503906965 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.503957987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.503974915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.504009962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.504031897 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.509329081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.509371996 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.509403944 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.509418011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.509480000 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.509500980 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.663070917 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.663131952 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.663158894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.663171053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.663203955 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.663222075 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.667680979 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.667730093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.667767048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.667774916 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.667802095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.673299074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.673352957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.673368931 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.673393011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.673445940 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.678721905 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.678745985 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.678792000 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.678809881 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.678826094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.684240103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.684262037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.684298992 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.684307098 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.684346914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.688353062 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.688375950 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.688416004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.688433886 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.688447952 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.688482046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.689065933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.689126968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.694634914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.694658041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.694700956 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.694709063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.694752932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.694787025 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.700066090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.700109959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.700141907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.700149059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.700200081 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.854868889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.854932070 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.854973078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.854986906 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.855004072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.855057001 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.859895945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.860008001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.860040903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.860049009 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.863908052 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.863909006 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.864823103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.864883900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.864908934 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.864916086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.864964962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.870546103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.870590925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.870616913 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.870625019 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.870656967 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.870692015 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.875925064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.875977039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.876004934 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.876013994 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.876065969 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.876221895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.881104946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.881177902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.881256104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.881263018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.881297112 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.881397963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.881450891 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.881459951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.886686087 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.886712074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.886759996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.886769056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.886842966 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.892317057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.892343998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.892395020 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.892412901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:04.892427921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:04.947547913 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.047074080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.047099113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.047142029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.047159910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.047193050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.047245026 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.047245026 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.047275066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.048485994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.051728964 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.051748037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.051786900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.051832914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.051856995 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.051870108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.051950932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.057358980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.057404041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.057471037 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.057486057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.057514906 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.057602882 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.062839031 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.062942982 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.062983990 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.062997103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.063024044 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.063136101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.067784071 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.067826033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.067888021 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.067899942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.067931890 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.067996025 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.073690891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.073734999 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.073779106 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.073793888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.073827982 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.073889971 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.078546047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.078592062 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.078639984 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.078651905 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.078692913 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.078758001 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.084224939 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.084265947 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.084320068 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.084331989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.084366083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.084413052 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.238605022 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.238656998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.238795042 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.238795042 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.238827944 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.238956928 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.244113922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.244167089 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.244254112 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.244268894 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.244312048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.244334936 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.249588013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.249638081 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.249685049 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.249697924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.249732018 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.249778032 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.254508972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.254550934 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.254607916 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.254621029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.254657030 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.254741907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.259973049 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.260019064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.260066032 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.260078907 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.260117054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.260188103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.265217066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.265261889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.265311003 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.265322924 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.265356064 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.265505075 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.270699978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.270741940 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.270807028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.270819902 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.270855904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.270956993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.276268005 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.276312113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.276360989 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.276372910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.276422977 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.276482105 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.430811882 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.430861950 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.430919886 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.430968046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.431013107 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.431092978 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.435697079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.435741901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.435785055 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.435800076 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.435853958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.435898066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.441673040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.441735983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.441773891 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.441788912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.441824913 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.442176104 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.447619915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.447665930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.447767973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.447767973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.447784901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.447948933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.451597929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.451643944 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.451689005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.451700926 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.451740026 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.452049971 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.457648993 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.457698107 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.457798004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.457798004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.457813025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.458316088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.462481976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.462532997 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.462574959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.462589025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.462632895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.462898970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.468030930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.468075037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.468117952 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.468131065 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.468168020 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.468511105 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.623224974 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.623290062 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.623380899 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.623434067 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.623471975 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.623739004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.627527952 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.627577066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.627619028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.627640963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.627676010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.627803087 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.634016991 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.634067059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.634109974 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.634123087 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.634171963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.634685040 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.638940096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.638984919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.639024973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.639039040 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.639072895 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.639471054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.644218922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.644269943 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.644313097 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.644325018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.644364119 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.644534111 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.648874044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.648916960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.648962975 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.648976088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.649012089 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.649411917 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.649553061 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.649566889 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.654350042 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.654400110 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.654458046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.654473066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.654520035 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.656618118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.656702042 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.656716108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.656836033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.661657095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.661700964 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.661742926 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.661756039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.661796093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.661840916 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.816557884 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.816617012 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.816757917 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.816757917 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.816791058 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.817079067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.822273970 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.822320938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.822365046 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.822381973 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.822418928 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.822479010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.827467918 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.827516079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.827559948 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.827574015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.827610970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.827693939 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.832727909 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.832771063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.832854986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.832854986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.832870960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.833184958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.838191032 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.838241100 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.838284969 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.838296890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.838332891 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.838519096 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.843219042 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.843265057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.843310118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.843322039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.843355894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.843413115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.848921061 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.848962069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.849004030 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.849015951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.849056959 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.849128008 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.854324102 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.854366064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.854461908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.854461908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:05.854475975 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:05.855928898 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.008131027 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.008249998 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.008280993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.008352041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.008402109 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.008402109 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.011209011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.011305094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.016119003 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.016165972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.016206980 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.016244888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.016285896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.016309977 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.021624088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.021668911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.021701097 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.021716118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.021747112 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.021764994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.027240038 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.027285099 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.027319908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.027337074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.027376890 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.027376890 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.032525063 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.032569885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.032603979 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.032617092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.032665968 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.032687902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.033200979 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.033265114 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.033947945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.034013033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.039575100 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.039617062 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.039653063 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.039665937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.039699078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.044540882 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.044598103 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.044644117 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.044657946 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.044689894 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.088161945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.208156109 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.208182096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.208226919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.208249092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.208344936 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.208344936 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.208344936 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.208424091 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.209515095 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.210776091 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.210845947 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.210856915 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.210880995 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.210921049 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.216005087 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.216052055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.216078997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.216094017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.216133118 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.222110033 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.222161055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.222186089 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.222206116 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.222321033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.227230072 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.227281094 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.227324009 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.227334023 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.227365017 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.236346006 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.236376047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.236421108 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.236434937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.236464024 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.239721060 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.239758015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.239797115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.239806890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.239850998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.244595051 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.244631052 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.244664907 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.244674921 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.244723082 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.291290998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.399358034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.399367094 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.399434090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.399440050 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.399467945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.399499893 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.399507046 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.399521112 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.399549961 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.402540922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.402586937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.402606010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.402611971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.402643919 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.407505035 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.407517910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.407584906 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.407593966 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.412956953 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.412969112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.413052082 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.413062096 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.418673038 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.418684959 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.418736935 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.418745041 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.418778896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.423818111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.423830986 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.423877001 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.423883915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.423918962 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.429481983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.429493904 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.429552078 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.429562092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.429600954 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.434264898 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.434278011 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.434374094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.434382915 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.478867054 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.589212894 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.589225054 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.589263916 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.589287043 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.589289904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.589320898 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.589339972 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.589364052 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.594757080 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.594774008 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.594810009 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.594845057 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.594857931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.594901085 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.594923973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.599654913 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.599673986 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.599725008 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.599736929 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.599775076 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.599803925 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.605403900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.605446100 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.605482101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.605489969 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.605530024 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.605551004 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.610857964 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.610872984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.610934973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.610941887 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.610989094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.615852118 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.615869045 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.615928888 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.615937948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.615988016 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.616648912 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.616712093 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.621613026 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.621627092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.621694088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.621702909 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.621756077 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.627173901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.627187967 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.627244949 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.627254009 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.627299070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.781555891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.781573057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.781642914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.781702995 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.781744957 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.781766891 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.787201881 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.787214994 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.787287951 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.787302971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.787367105 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.792826891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.792850018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.792954922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.792974949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.793041945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.797663927 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.797678947 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.797739983 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:06.797754049 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:06.797807932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.015333891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.060714960 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.271333933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.271480083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.711345911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.711550951 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914164066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914225101 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914268017 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914346933 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914365053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914417028 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914439917 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914474964 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914475918 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914475918 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914485931 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914515972 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914544106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914570093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914598942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914627075 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914627075 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914645910 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914663076 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914674044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914688110 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914688110 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914694071 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914709091 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914735079 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914742947 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914761066 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914767027 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914815903 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914830923 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914844990 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914858103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914870977 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914885044 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914915085 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914926052 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914963007 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.914973021 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.914983034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915005922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915015936 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915071011 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915076971 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915105104 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915136099 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915143967 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915196896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915205956 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915256023 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915266991 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915277004 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915304899 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915304899 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915314913 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915348053 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915374994 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915383101 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915399075 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915429115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915438890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915488958 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915498018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915510893 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915544987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915551901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915574074 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915594101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915605068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915625095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915643930 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915652037 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915685892 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915693998 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915756941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915764093 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915777922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915792942 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915797949 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915852070 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915867090 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915884018 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915884018 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915891886 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915905952 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915937901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915947914 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.915985107 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.915990114 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916002989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916023016 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916030884 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916064024 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916069984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916083097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916105986 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916114092 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916148901 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916152954 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916165113 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916182995 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916202068 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916214943 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916218996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916218996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916229963 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916261911 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916316986 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916332960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916352034 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916359901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916389942 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916390896 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916410923 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916420937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916428089 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916471004 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916486025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916506052 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916506052 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916515112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916529894 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916548014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916560888 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916599989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916614056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916631937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916641951 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916654110 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916668892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916680098 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.916696072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916763067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916763067 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.916769028 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.922005892 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.932806015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.932820082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.932883024 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.932897091 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.938294888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.938313961 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.938359976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.938375950 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.938426971 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.943962097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.943975925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.944025993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.944041014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.944075108 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.948847055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.948863983 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.948915005 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.948930025 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.948961973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.954421997 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.954442024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.954488993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.954503059 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.954533100 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.959775925 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.959793091 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.959836960 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.959851027 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.959899902 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.965121984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.965135098 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.965243101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.965243101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.965260029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.970741034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.970753908 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.970809937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:07.970824957 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:07.970856905 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.025788069 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.125345945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.125354052 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.125441074 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.125488997 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.125570059 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.130769968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.130799055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.130851030 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.130867958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.130906105 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.130928040 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.136229038 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.136253119 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.136318922 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.136332035 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.136360884 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.136405945 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.141525984 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.141558886 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.141602039 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.141616106 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.141645908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.141670942 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.146748066 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.146769047 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.146817923 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.146831036 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.146866083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.146891117 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.151943922 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.151964903 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.152031898 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.152046919 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.152096033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.157917976 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.157937050 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.157984972 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.157999992 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.158031940 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.158075094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.163012981 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.163038015 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.163084984 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.163098097 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.163127899 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.163151979 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.317622900 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.317646980 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.317697048 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.317754030 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.317790031 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.317961931 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.322577000 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.322599888 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.322638035 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.322649002 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.322669983 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.322685957 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.328135967 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.328156948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.328202963 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.328211069 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.328226089 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.328248024 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.333029985 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.333053112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.333087921 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.333101034 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.333131075 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.333172083 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.339730978 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.339751005 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.339799881 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.339818001 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.339843035 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.339875937 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.343936920 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.343957901 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.344001055 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.344018936 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.344043016 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.345145941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.349391937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.349412918 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.349452019 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.349462986 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.349492073 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.349788904 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.354974985 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.354998112 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.355062008 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.355082989 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.355143070 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.509550095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.509572029 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.509756088 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.509757042 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.509825945 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.509892941 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.514349937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.514373064 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.514420033 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.514436960 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.514468908 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.514489889 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.520051003 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.520072937 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.520114899 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.520128965 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.520158052 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.520178080 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.525621891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.525641918 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.525682926 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.525695086 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.525726080 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.525758028 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.531088114 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.531109095 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.531157017 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.531168938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.531199932 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.531259060 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.536238909 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.536259890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.536300898 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.536313057 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.536341906 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.536384106 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.541189909 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.541212082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.541265965 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.541277885 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.541306973 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.541333914 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.546794891 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.546816111 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.546849966 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.546860933 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.546888113 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.547010899 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.702593088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.702619076 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.702790976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.702790976 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.702857018 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.702914953 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.707371950 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.707391024 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.707437992 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.707459927 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.707489967 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.707513094 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.713665962 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.713691950 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.713772058 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.713787079 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.713860989 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.718426943 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.718446970 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.718492031 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.718506098 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.718534946 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.718717098 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.724081039 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.724101067 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.724153996 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.724172115 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.724196911 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.724380970 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.729091883 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.729114056 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.729156017 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.729167938 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.729196072 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.729242086 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.734174013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.734195948 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.734236002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.734247923 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.734280109 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.734657049 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.739937067 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.739958048 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.740000010 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.740011930 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.740096092 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.740123987 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.893488884 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.893513918 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.893568993 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.893620014 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.893659115 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.893683910 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.896027088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.896091938 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.901462078 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.901484013 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.901540041 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.901554108 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.901592016 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.901612997 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.906394005 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.906419992 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.906460047 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.906471968 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.906500101 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.906522036 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.912038088 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.912067890 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.912106037 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.912117958 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.912147999 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.912431002 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.917175055 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.917195082 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.917246103 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.917263031 CET	443	49896	13.227.8.66	192.168.2.4
Dec 12, 2024 11:17:08.917289019 CET	49896	443	192.168.2.4	13.227.8.66
Dec 12, 2024 11:17:08.917329073 CET	49896	443	192.168.2.4	13.227.8.66

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 11:15:03.764759064 CET	192.168.2.4	1.1.1.1	0x1795	Standard query (0)	agent-api.atera.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:15:14.939487934 CET	192.168.2.4	1.1.1.1	0x3db5	Standard query (0)	agent-api.atera.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:15:18.289608955 CET	192.168.2.4	1.1.1.1	0xd059	Standard query (0)	ps.pndsn.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:15:30.542644024 CET	192.168.2.4	1.1.1.1	0x9437	Standard query (0)	ps.pndsn.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:17.917776108 CET	192.168.2.4	1.1.1.1	0xfe4d	Standard query (0)	agent-api.atera.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:22.013839960 CET	192.168.2.4	1.1.1.1	0x3472	Standard query (0)	ps.atera.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:29.948904991 CET	192.168.2.4	1.1.1.1	0x85ba	Standard query (0)	agent-api.atera.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:40.284241915 CET	192.168.2.4	1.1.1.1	0xf400	Standard query (0)	my.splashtop.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:41.557775974 CET	192.168.2.4	1.1.1.1	0x9ae1	Standard query (0)	agent-api.atera.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:42.971584082 CET	192.168.2.4	1.1.1.1	0x90d1	Standard query (0)	download.splashtop.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:52.339385033 CET	192.168.2.4	1.1.1.1	0xe3ec	Standard query (0)	agent-api.atera.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:17:01.970669031 CET	192.168.2.4	1.1.1.1	0x4c20	Standard query (0)	agent-api.atera.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:17:03.358645916 CET	192.168.2.4	1.1.1.1	0x928c	Standard query (0)	agent-api.atera.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:17:21.775784016 CET	192.168.2.4	1.1.1.1	0x8453	Standard query (0)	agent-api.atera.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:17:27.172916889 CET	192.168.2.4	1.1.1.1	0xfb6a	Standard query (0)	api.nuget.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 11:15:04.118943930 CET	1.1.1.1	192.168.2.4	0x1795	No error (0)	agent-api.atera.com	agentsapi.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:15:11.093776941 CET	1.1.1.1	192.168.2.4	0x64c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:15:11.093776941 CET	1.1.1.1	192.168.2.4	0x64c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:15:12.475713015 CET	1.1.1.1	192.168.2.4	0xc12b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:15:12.475713015 CET	1.1.1.1	192.168.2.4	0xc12b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:15:14.013933897 CET	1.1.1.1	192.168.2.4	0xd552	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:15:14.013933897 CET	1.1.1.1	192.168.2.4	0xd552	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:15:14.062541962 CET	1.1.1.1	192.168.2.4	0xf883	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:15:14.062541962 CET	1.1.1.1	192.168.2.4	0xf883	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:15:15.270843983 CET	1.1.1.1	192.168.2.4	0x3db5	No error (0)	agent-api.atera.com	agentsapi.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:15:18.431255102 CET	1.1.1.1	192.168.2.4	0xd059	No error (0)	ps.pndsn.com		13.232.67.198	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:15:18.431255102 CET	1.1.1.1	192.168.2.4	0xd059	No error (0)	ps.pndsn.com		13.232.67.199	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:15:30.680985928 CET	1.1.1.1	192.168.2.4	0x9437	No error (0)	ps.pndsn.com		13.232.67.198	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:15:30.680985928 CET	1.1.1.1	192.168.2.4	0x9437	No error (0)	ps.pndsn.com		13.232.67.199	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:14.195626020 CET	1.1.1.1	192.168.2.4	0x8f5d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:14.195626020 CET	1.1.1.1	192.168.2.4	0x8f5d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:18.520224094 CET	1.1.1.1	192.168.2.4	0xfe4d	No error (0)	agent-api.atera.com	agentsapi.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:16:22.258457899 CET	1.1.1.1	192.168.2.4	0x3472	No error (0)	ps.atera.com	d25btwd9wax8gu.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:16:22.258457899 CET	1.1.1.1	192.168.2.4	0x3472	No error (0)	d25btwd9wax8gu.cloudfront.net		52.222.144.9	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:22.258457899 CET	1.1.1.1	192.168.2.4	0x3472	No error (0)	d25btwd9wax8gu.cloudfront.net		52.222.144.108	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:22.258457899 CET	1.1.1.1	192.168.2.4	0x3472	No error (0)	d25btwd9wax8gu.cloudfront.net		52.222.144.123	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:22.258457899 CET	1.1.1.1	192.168.2.4	0x3472	No error (0)	d25btwd9wax8gu.cloudfront.net		52.222.144.13	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:25.811384916 CET	1.1.1.1	192.168.2.4	0x23fe	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:16:25.811384916 CET	1.1.1.1	192.168.2.4	0x23fe	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:30.288830996 CET	1.1.1.1	192.168.2.4	0x85ba	No error (0)	agent-api.atera.com	agentsapi.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:16:40.851284981 CET	1.1.1.1	192.168.2.4	0xf400	No error (0)	my.splashtop.com	default-my.splashtop.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:16:40.851284981 CET	1.1.1.1	192.168.2.4	0xf400	No error (0)	default-my.splashtop.com	ga-my.splashtop.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:16:40.851284981 CET	1.1.1.1	192.168.2.4	0xf400	No error (0)	ga-my.splashtop.com	a6dc35606b2c6816e.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:16:40.851284981 CET	1.1.1.1	192.168.2.4	0xf400	No error (0)	a6dc35606b2c6816e.awsglobalaccelerator.com		52.223.39.232	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:40.851284981 CET	1.1.1.1	192.168.2.4	0xf400	No error (0)	a6dc35606b2c6816e.awsglobalaccelerator.com		35.71.184.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:41.887397051 CET	1.1.1.1	192.168.2.4	0x9ae1	No error (0)	agent-api.atera.com	agentsapi.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:16:43.116189957 CET	1.1.1.1	192.168.2.4	0x90d1	No error (0)	download.splashtop.com	default-download.splashtop.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:16:43.116189957 CET	1.1.1.1	192.168.2.4	0x90d1	No error (0)	default-download.splashtop.com	d17kmd0va0f0mp.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:16:43.116189957 CET	1.1.1.1	192.168.2.4	0x90d1	No error (0)	d17kmd0va0f0mp.cloudfront.net		13.227.8.66	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:43.116189957 CET	1.1.1.1	192.168.2.4	0x90d1	No error (0)	d17kmd0va0f0mp.cloudfront.net		13.227.8.84	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:43.116189957 CET	1.1.1.1	192.168.2.4	0x90d1	No error (0)	d17kmd0va0f0mp.cloudfront.net		13.227.8.46	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:43.116189957 CET	1.1.1.1	192.168.2.4	0x90d1	No error (0)	d17kmd0va0f0mp.cloudfront.net		13.227.8.14	A (IP address)	IN (0x0001)	false
Dec 12, 2024 11:16:52.653701067 CET	1.1.1.1	192.168.2.4	0xe3ec	No error (0)	agent-api.atera.com	agentsapi.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:17:02.111960888 CET	1.1.1.1	192.168.2.4	0x4c20	No error (0)	agent-api.atera.com	agentsapi.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:17:03.662561893 CET	1.1.1.1	192.168.2.4	0x928c	No error (0)	agent-api.atera.com	agentsapi.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:17:22.331273079 CET	1.1.1.1	192.168.2.4	0x8453	No error (0)	agent-api.atera.com	agentsapi.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:17:27.624413967 CET	1.1.1.1	192.168.2.4	0xfb6a	No error (0)	api.nuget.org	nugetapiprod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 11:17:27.624413967 CET	1.1.1.1	192.168.2.4	0xfb6a	No error (0)	cs2.wpc.gammacdn.net		152.199.23.209	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49746	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:15:20 UTC	183	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=afd68752-dbb1-4629-bb7a-4b992b45f2ca&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com Connection: Keep-Alive
2024-12-12 10:15:21 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:15:21 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:15:21 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 35 32 31 30 36 35 31 30 35 39 5d Data Ascii: [17339985210651059]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49747	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:15:20 UTC	364	OUT	GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=76d4ae57-17bf-4f80-941f-dfaec85e70ea&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com Connection: Keep-Alive
2024-12-12 10:15:21 UTC	277	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:15:21 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 45 Connection: close Cache-Control: no-cache Access-Control-Allow-Methods: GET Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:15:21 UTC	45	IN	Data Raw: 7b 22 74 22 3a 7b 22 74 22 3a 22 31 37 33 33 39 39 38 35 32 30 39 39 37 33 30 33 36 22 2c 22 72 22 3a 33 31 7d 2c 22 6d 22 3a 5b 5d 7d Data Ascii: {"t":{"t":"17339985209973036","r":31},"m":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49751	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:15:24 UTC	183	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=51a415c1-2b2c-4b67-8c44-1c23b5006966&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com Connection: Keep-Alive
2024-12-12 10:15:24 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:15:24 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:15:24 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 35 32 34 34 38 30 36 37 32 31 5d Data Ascii: [17339985244806721]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49752	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:15:24 UTC	386	OUT	GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=774b77be-1c5d-40a4-aaf9-a271b56e415d&tr=31&tt=17339985209973036&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com Connection: Keep-Alive
2024-12-12 10:16:21 UTC	279	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:21 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 1874 Connection: close Cache-Control: no-cache Access-Control-Allow-Methods: GET Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:21 UTC	1874	IN	Data Raw: 7b 22 74 22 3a 7b 22 74 22 3a 22 31 37 33 33 39 39 38 35 38 31 35 36 36 35 36 34 30 22 2c 22 72 22 3a 33 31 7d 2c 22 6d 22 3a 5b 7b 22 61 22 3a 22 32 22 2c 22 66 22 3a 30 2c 22 69 22 3a 22 37 66 65 62 62 36 36 33 2d 33 34 39 66 2d 34 35 61 34 2d 62 33 65 65 2d 36 36 30 37 30 64 33 61 33 38 38 36 22 2c 22 70 22 3a 7b 22 74 22 3a 22 31 37 33 33 39 39 38 35 38 31 35 36 36 35 36 34 30 22 2c 22 72 22 3a 34 33 7d 2c 22 6b 22 3a 22 73 75 62 2d 63 2d 61 30 32 63 65 63 61 38 2d 61 39 35 38 2d 31 31 65 35 2d 62 64 38 63 2d 30 36 31 39 66 38 39 34 35 61 34 66 22 2c 22 63 22 3a 22 31 34 32 31 36 66 61 36 2d 64 63 31 35 2d 34 35 31 39 2d 61 63 66 39 2d 66 30 65 31 62 33 34 39 35 34 62 36 22 2c 22 64 22 3a 7b 22 43 6f 6d 6d 61 6e 64 49 64 22 3a 22 64 66 64 30 38 66 37 Data Ascii: {"t":{"t":"17339985815665640","r":31},"m":[{"a":"2","f":0,"i":"7febb663-349f-45a4-b3ee-66070d3a3886","p":{"t":"17339985815665640","r":43},"k":"sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f","c":"14216fa6-dc15-4519-acf9-f0e1b34954b6","d":{"CommandId":"dfd08f7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49773	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:09 UTC	159	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=052b3658-a246-45af-9f6e-3245310762d8&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com
2024-12-12 10:16:10 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:09 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:10 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 35 36 39 37 35 38 32 37 33 36 5d Data Ascii: [17339985697582736]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49779	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:12 UTC	358	OUT	GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=5b0253c2-a85c-4e9c-930f-3ee261c0dba3&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:16:12 UTC	322	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:12 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 55 Connection: close Access-Control-Allow-Methods: OPTIONS, GET, POST Age: 0 Cache-Control: no-cache Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:12 UTC	55	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 20 32 30 30 2c 20 22 6d 65 73 73 61 67 65 22 3a 20 22 4f 4b 22 2c 20 22 73 65 72 76 69 63 65 22 3a 20 22 50 72 65 73 65 6e 63 65 22 7d Data Ascii: {"status": 200, "message": "OK", "service": "Presence"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49815	52.222.144.9	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:23 UTC	212	OUT	GET /agentpackagesnet45/AgentPackageAgentInformation/38.3/AgentPackageAgentInformation.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1 Host: ps.atera.com Connection: Keep-Alive
2024-12-12 10:16:24 UTC	671	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 384894 Connection: close Content-MD5: q6TGBHz+wnttsT4PED9L2w== Last-Modified: Sat, 07 Dec 2024 18:19:49 GMT Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 2446d31d-701e-0048-2ea4-4a60fd000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Thu, 12 Dec 2024 01:42:13 GMT ETag: 0x8DD16EBBCA241FD Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 39bbadf156391937a290aa263268420c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MRS52-C2 X-Amz-Cf-Id: iVb5glZ1uRYmCMtfY7a-voxEU1sjLUcxzQOpJnPsnqfkiuk5X2MT4w== Age: 30854
2024-12-12 10:16:24 UTC	15713	IN	Data Raw: 50 4b 03 04 2d 00 09 08 08 00 75 92 87 59 03 e6 70 8c ff ff ff ff ff ff ff ff 3d 00 14 00 41 67 65 6e 74 50 61 63 6b 61 67 65 41 67 65 6e 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 2f 41 67 65 6e 74 50 61 63 6b 61 67 65 41 67 65 6e 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 2e 65 78 65 01 00 10 00 28 ba 02 00 00 00 00 00 38 1d 01 00 00 00 00 00 84 02 90 4a 2e 94 30 a0 ae 07 fa 3a 13 e0 ae e0 97 fc ef da 16 67 67 5a 0a 06 a5 da 2e 81 ec 28 3b 34 6a 79 88 b8 89 2f 15 af cd a4 6c 8f dd bb fe 42 e7 f4 9f 4a ab 96 b3 fc 2c d3 b3 19 37 3b f4 32 61 f4 f5 7a 86 5e d2 c1 89 bf 12 64 df d2 af c7 8b d8 d8 52 85 81 cf ba e5 c8 42 0a c7 93 ab 81 55 36 2d 8d 6a e7 44 99 7d d9 f5 37 28 aa 0d 4f c9 c3 d9 7b 3c da c0 eb 5e 03 05 ee 52 95 e2 c5 24 58 e3 c6 0d ab a4 85 f4 67 de 75 00 b9 Data Ascii: PK-uYp=AgentPackageAgentInformation/AgentPackageAgentInformation.exe(8J.0:ggZ.(;4jy/lBJ,7;2az^dRBU6-jD}7(O{<^R$Xgu
2024-12-12 10:16:24 UTC	16384	IN	Data Raw: 7b 0d a7 c4 55 b7 06 17 fd 88 19 1c 56 98 f4 53 21 a4 66 4c ce 0f 0c 0d 8c 50 d9 d9 71 7b 80 dd 1e 1f a6 7d 2b ae 1c 58 96 5f 52 34 30 33 57 3a d2 89 78 8b 4f 3d 70 88 bc 02 c0 24 64 c0 58 47 43 d9 f4 29 6d a9 c1 e5 9c 59 61 1f 32 65 5a 80 42 df ca 44 39 80 67 3f 46 1e bc b2 9c ef a6 c7 40 61 9b 31 ef 88 06 73 b1 52 bf 59 f2 03 88 12 9e f7 5a 49 1d 67 31 b8 b5 15 47 b8 7e 14 66 27 1a ba c2 c2 32 5c 34 22 79 16 c3 a8 84 b9 ab 63 0a da 29 3e d6 8c fe 81 99 01 89 3a 48 99 0e 90 c2 0b 40 a6 3a bf 46 d8 02 0d bb 6c 1d 86 98 3f 57 dc 0d 18 4e e3 29 98 98 0a 9c 1a 42 6b e1 5b 87 29 58 58 35 6d b1 96 4c 59 52 c5 fd 2f 32 48 aa c3 09 69 2f 17 4f 01 b2 57 4a 41 84 80 fe 3d dd fd 47 e4 90 58 cb 73 c5 c6 84 ad eb ff a4 16 a7 de 66 2b fc e4 b3 ad 76 d7 36 02 fa b8 c6 Data Ascii: {UVS!fLPq{}+X_R403W:xO=p$dXGC)mYa2eZBD9g?F@a1sRYZIg1G~f'2\4"yc)>:H@:Fl?WN)Bk[)XX5mLYR/2Hi/OWJA=GXsf+v6
2024-12-12 10:16:24 UTC	16384	IN	Data Raw: 04 e7 39 6f a9 4a fb 61 8b 73 30 f9 1d e5 71 f5 80 39 cf 60 c6 94 98 51 9a f2 cc 90 a1 76 cc 01 6c 91 3d 11 db ee c0 b9 dc 70 2a af f5 8a 51 fe 4b 57 f5 a0 c2 b2 73 2c c9 7f 1d 4b b9 53 10 fe f2 79 55 db 11 e7 f7 f1 e3 14 43 09 36 21 e2 73 07 cf 98 a2 fb bd 6e 5f bb f9 f2 e8 83 fe 71 96 d5 df 31 eb a7 23 40 06 6e 29 cd 8b 56 56 38 c6 c9 9c f3 e8 45 22 98 2e 73 ad c2 a1 99 98 08 da 64 6a 2a 29 3a 5b 57 e9 6d 82 ec be 9d ae 27 20 2f ab 7c 50 12 84 d9 44 61 ef 63 7e 5b 68 23 f7 f4 92 d4 68 57 91 24 b3 91 47 8f 87 92 1c 2c 86 5d 52 46 dc 70 13 16 75 ef 9a 42 3a f5 a3 52 df 3e 07 ab eb 4c 95 43 99 e0 50 e1 b8 37 62 97 15 36 8c 0b 38 5a 24 12 f1 5e 09 c2 46 56 e4 83 ea 1c c4 de 68 b5 49 c7 05 2b 67 42 da 85 5c df 58 df 59 7e ce 73 1a 4d 8f 8c 3a 86 1c d2 64 7a Data Ascii: 9oJas0q9`Qvl=pQKWs,KSyUC6!sn_q1#@n)VV8E".sdj):[Wm' /\|PDac~[h#hW$G,]RFpuB:R>LCP7b68Z$^FVhI+gB\XY~sM:dz
2024-12-12 10:16:24 UTC	16384	IN	Data Raw: 81 58 bb 1e 8e dd 2f f8 bd b7 5a 66 96 ce 34 05 8c d3 7c ac 4f 29 8b 7e 95 e3 45 8f ac 10 a0 2b 1c d3 0c 62 9c 1a 55 8e c9 8f 8e de f8 22 6a c4 26 31 75 d7 5a f5 82 6f 57 bd c0 52 29 9d 8c 9a a5 54 3a c5 c5 5e a9 d7 96 d5 66 46 43 29 76 47 f2 e9 04 5d 56 68 ba 79 49 bd 47 69 fb 3b c7 73 4d 42 16 cd ca d4 90 71 b5 87 7e 15 65 da 4c e9 11 5b bc f4 25 2a be f5 52 c0 e8 08 e8 d6 d4 a2 af ac fa 0b 56 ff 28 02 ae 52 55 f2 39 8e 79 a4 f2 74 2f f6 79 eb 3b c3 cd 91 51 18 3a 8d a8 16 21 85 e6 12 b5 7e 3a a3 c1 3a f0 0a 4d 2e b0 7c 5f 42 72 14 49 bb 75 0b 99 6f 94 df 67 8d 73 7d b6 ed 92 00 17 e0 6e a4 bc ff 79 fa 7d ed 6b da 2f e2 a4 71 6d ec 43 85 10 3a fd 0d 2c 0e e1 ef 6b a1 8e 7f 5e e2 86 49 94 16 51 a5 dc 09 57 3f 74 bc 54 9b 93 86 f2 6b fc e7 2d f7 7c 40 92 Data Ascii: X/Zf4\|O)~E+bU"j&1uZoWR)T:^fFC)vG]VhyIGi;sMBq~eL[%*RV(RU9yt/y;Q:!~::M.\|_BrIuogs}ny}k/qmC:,k^IQW?tTk-\|@
2024-12-12 10:16:24 UTC	16384	IN	Data Raw: 55 bb f9 86 d3 03 86 b0 f9 3f a2 00 20 1c 58 a4 0c 8f 75 9a bd 80 21 2f bb 3f d8 7a 03 92 01 14 b3 2e 49 76 21 82 11 c8 05 44 9e 57 9a ce 3d b1 13 bf fd bb 33 61 6f f5 98 ad 40 07 25 c3 91 9a fb 2d 53 97 fd 4f c5 be 55 25 09 dd 55 64 29 5c 51 74 b2 a9 67 9b 6c 18 db 29 6d 09 d9 00 77 5f 15 0b 5f 27 ff 31 a2 23 f6 ba 92 90 2d a1 4e 3c 6b 21 60 0c 27 ed f0 4e 7d f6 c6 72 2b f1 38 18 77 eb 88 2a 8e 78 a7 47 7c f8 9c 0d 71 44 f4 35 7c 10 c3 3a e4 61 2a c6 1f be 93 93 b8 07 19 1f d4 b6 9b 96 0a c8 59 d1 8a 8c 93 fa 88 c5 1e b7 f2 d5 ef 78 1e e9 0c e5 9a 4c 42 bf fc 6f d4 63 05 d8 c8 00 a7 70 3c c7 d2 46 3a 3a 7c 45 f6 8e f3 47 d9 09 3b 9c f3 87 b6 1a 11 c3 7e c0 f4 04 26 81 f9 f8 3d 1a c9 ab 16 29 23 ae 4e 4a a5 f0 9d 02 b4 30 6b d1 a7 37 14 2d f3 d4 08 7d 36 Data Ascii: U? Xu!/?z.Iv!DW=3ao@%-SOU%Ud)\Qtgl)mw__'1#-N<k!`'N}r+8wxG\|qD5\|:aYxLBocp<F::\|EG;~&=)#NJ0k7-}6
2024-12-12 10:16:24 UTC	16384	IN	Data Raw: 0a 40 72 fd bd 61 52 40 70 6b 40 7f af f1 f3 e4 35 fc 37 29 80 f9 87 77 a6 d0 77 ad e1 53 82 77 1f c9 f7 57 41 22 8b d6 29 dc a4 cf e1 b6 ef f5 3f 73 05 66 bb 0d 17 1c ad ce 6b bc dd fd 6e b7 95 42 42 04 bc a4 45 51 0c e6 40 fd be e8 0f ab ad 08 6a 36 21 94 fd b3 bb 8f cd 8c 23 af 9d 22 40 f5 37 9f 64 4c 70 b5 b0 42 b2 9d 3c 19 3c 7d bb ad 66 c2 a6 f0 a9 68 64 c9 a4 ff 13 fa 4a 4b 9f 01 95 ea 8f 13 03 ee 78 84 4e 29 0e 16 35 52 61 0b c7 96 87 fc 42 39 e2 da e5 8d 28 93 00 8b 0a 64 89 2d 26 d2 51 2b ae 65 90 69 1c 64 18 ac b3 19 52 e4 67 48 53 2c 30 e2 0b 9c 31 98 6e b2 d8 37 cb 28 d3 88 28 e3 23 2e 2d 44 3f ef ab 2f 44 a3 21 2d cc 30 6c 9b 9f ea 0a c3 31 16 d9 f4 65 07 5b 25 43 b9 48 c6 d9 23 7e 2e 3a a0 1f 7d c3 4d 1e 84 b4 22 eb 34 c0 0c e6 5e d0 9a fa Data Ascii: @raR@pk@57)wwSwWA")?sfknBBEQ@j6!#"@7dLpB<<}fhdJKxN)5RaB9(d-&Q+eidRgHS,01n7((#.-D?/D!-0l1e[%CH#~.:}M"4^
2024-12-12 10:16:24 UTC	16384	IN	Data Raw: 48 58 42 2a 06 19 3c c0 07 b0 2f e3 44 01 c6 44 8f 82 f6 ee 44 74 79 fb f2 48 1a 4f f7 84 7a 0e 99 ce 30 1a d4 6f 55 66 45 17 2a 24 a9 ca 3f 73 4a 2b 70 d2 5c 4a 86 e6 af dc f2 1c 5c b8 02 99 be 4d 7a 52 40 af 7c 51 a1 2e 3b 85 6e c9 2b 3f 99 60 aa ae ed 2b d3 86 22 db f0 b7 0a e8 c1 d4 c9 0f 0e b0 e2 fa 29 f4 03 6a f6 a3 30 1d aa 26 c0 4d e5 93 1b 87 e4 16 09 35 de 74 9d df b0 c7 11 aa 0a e7 42 be 09 94 08 ca 19 9b 3e a4 74 4e 66 17 90 28 2d 92 2c d5 88 8a 2a 6c 5d 95 6e 25 5e 76 cb cd b5 31 2f 5f 76 3b be 81 de 6a 9b f3 0f 43 7c 03 e2 41 da f3 6c 8a 9a 45 af 5b 7e 89 31 aa 92 da 27 51 70 a2 44 cb 5a 7c 41 5f 77 fd 1b ee d1 5b 7b d7 0e 32 0f f4 57 21 33 ba ce ea f3 f1 29 13 d4 78 a3 d9 7e 60 41 cd c6 e7 e5 45 6e 28 51 f9 f1 18 f6 3a 72 71 c1 1d b1 e0 9b Data Ascii: HXB</DDDtyHOz0oUfE$?sJ+p\J\MzR@\|Q.;n+?`+")j0&M5tB>tNf(-,*l]n%^v1/_v;jC\|AlE[~1'QpDZ\|A_w[{2W!3)x~`AEn(Q:rq
2024-12-12 10:16:24 UTC	16384	IN	Data Raw: f2 61 a4 51 07 85 0b a1 25 83 9c 4c 7e ae 20 0f be 55 21 f8 a9 31 be 28 c9 60 b3 03 fc 86 ca 9a e7 71 8f 11 11 36 d6 15 1b f0 78 00 39 45 d1 7d c3 44 0d dc ac 3e 6b 48 46 ea bd f0 40 a0 f4 e2 06 ec 3c db 4e 19 58 9f da 93 5a c4 c7 8c 11 fa 24 d6 a4 cd ae 62 6a cd 5b 5f 07 b8 5d fc 10 32 58 07 bb e4 76 1b 2f ba 77 30 d8 cf e9 0e da 89 f6 30 d9 c9 a8 7e ba db 2f 3a 68 4c 49 eb f4 63 df b0 68 63 08 50 58 34 02 ae 00 c1 7c 63 d7 da ab 87 82 24 9d ae ef aa 78 7d 7a 84 c6 17 6f 0c bd 89 9a ce ec f6 b1 cc 1a 44 74 4a 61 5d 0c 2a fc b7 53 1f 86 80 eb 9d 7c 9b 94 4f b2 a1 89 fb a3 e8 7a 25 86 8e 01 21 6b 37 6d 28 4a 51 cd 8a 93 35 b1 70 c4 6c a5 e5 8e c2 2f 76 2b 67 dc 64 c1 e3 cd 0c 00 53 4e f0 07 7c 39 55 26 d1 f5 21 75 fb 7f dd 0e 74 b3 1b e2 95 fd 98 87 5a b2 Data Ascii: aQ%L~ U!1(`q6x9E}D>kHF@<NXZ$bj[_]2Xv/w00~/:hLIchcPX4\|c$x}zoDtJa]*S\|Oz%!k7m(JQ5pl/v+gdSN\|9U&!utZ
2024-12-12 10:16:24 UTC	16384	IN	Data Raw: b7 b6 18 43 04 aa 55 97 a6 54 30 0f dd fb 2b 39 e2 a4 f1 e5 4e 3e 8a 6f f5 93 c4 26 27 47 9b f3 1e 62 fe c4 85 ed 52 1e e0 12 ae 57 e3 e6 af 88 fa 91 2f 61 31 ad 97 57 8f 2d d8 4c 9a 7e e0 8c fa 42 bf d0 bf a3 bf 47 55 80 25 c8 1c f4 f8 95 d7 65 fa f7 fa 60 56 c7 e2 b0 00 39 fa ed 1a 0a 32 b7 73 cd 4c c2 48 ae 13 d7 87 a3 b9 26 42 e6 ea eb b4 2f 3b 9b f6 8d d4 43 11 36 6f 96 15 0b 62 4f 97 d0 64 90 42 3d 4d 88 28 35 bb 1b 7c cc 63 10 c9 5f 5c ca 11 9e cf 04 1b 2c 26 a3 74 d4 8a 1d 2d f4 de 24 24 87 19 2a a5 6b a0 03 40 61 85 9d 25 d6 61 1d 03 44 3a 2a 46 cc 64 1d 3f 57 fd c3 c4 e5 cf 27 85 4d 23 a4 b4 6d 8a ee 20 04 af 49 6c ec 1d 5b 8d 9d fa 78 9c 6f 31 16 72 3e 40 fa 2f 06 3f 91 ff 30 73 1c 28 ed eb dc af d8 26 bf b0 9d 97 c1 f7 69 34 27 bc ca 47 7b d3 Data Ascii: CUT0+9N>o&'GbRW/a1W-L~BGU%e`V92sLH&B/;C6obOdB=M(5\|c_\,&t-$$k@a%aD:Fd?W'M#m Il[xo1r>@/?0s(&i4'G{
2024-12-12 10:16:25 UTC	16384	IN	Data Raw: ee 6d 43 14 f7 01 2f 71 2b d6 01 fd b2 8d 94 82 3b f0 b3 42 af c8 cd cf ef 37 71 31 57 6b 9c a8 0e 24 e5 d2 4e 06 5f 06 b6 b1 cb b4 df e2 84 e8 40 1f 39 50 86 04 30 28 62 78 4b 44 c6 58 7f 1b d1 34 a2 0b bd 93 f3 b2 3a 2a 46 35 8d 69 81 af 86 98 f4 06 ae 1d 1f e1 58 34 97 20 5e 01 77 ca a4 63 9d 95 41 30 6f e4 3b 41 37 3f ca e3 2a 01 10 b3 21 b8 ac b1 c3 be f1 a1 36 d6 3e 40 79 1a fd fe fa b8 59 d2 95 16 53 54 8f 21 43 25 b6 9b 57 6e d0 b2 78 ae c8 c1 85 e5 73 9c a8 a6 23 cd 1a b7 2d e8 8c 17 a4 b7 19 ce 1b 61 16 3d a5 79 f9 7a 10 7e 09 78 1e 80 18 e8 b4 63 9f eb 52 b1 d4 07 2b 3a 30 c2 4d b6 d5 6c ae 5b 03 3e 74 77 2b 4c ac d0 73 56 2b 40 8a a4 45 91 1f 3f ca f3 4c a0 46 71 d1 0f 72 fa c7 44 e4 7b 4c f2 9e e6 83 e1 84 50 b9 43 31 75 71 55 5c a1 8b 91 2b Data Ascii: mC/q+;B7q1Wk$N_@9P0(bxKDX4:F5iX4 ^wcA0o;A7?!6>@yYST!C%Wnxs#-a=yz~xcR+:0Ml[>tw+LsV+@E?LFqrD{LPC1uqU\+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49814	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:24 UTC	362	OUT	GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=4001b75e-ef93-41e1-9164-a364993824c7&tr=31&tt=17339985815665640&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49813	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:24 UTC	159	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=01a07f47-4407-4c38-823d-6e5cc94bf07a&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com
2024-12-12 10:16:25 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:24 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:25 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 35 38 34 37 38 34 31 30 30 32 5d Data Ascii: [17339985847841002]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49832	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:29 UTC	159	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=225d0b69-c9ce-4d95-ac69-b9fe17405e9e&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com
2024-12-12 10:16:30 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:29 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:30 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 35 38 39 39 35 35 30 30 36 38 5d Data Ascii: [17339985899550068]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49830	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:29 UTC	354	OUT	GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=add1eec0-31bb-44fb-a0b1-c0a51d202d6e&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:16:30 UTC	322	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:30 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 74 Connection: close Access-Control-Allow-Methods: OPTIONS, GET, POST Age: 0 Cache-Control: no-cache Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:30 UTC	74	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 20 32 30 30 2c 20 22 6d 65 73 73 61 67 65 22 3a 20 22 4f 4b 22 2c 20 22 61 63 74 69 6f 6e 22 3a 20 22 6c 65 61 76 65 22 2c 20 22 73 65 72 76 69 63 65 22 3a 20 22 50 72 65 73 65 6e 63 65 22 7d Data Ascii: {"status": 200, "message": "OK", "action": "leave", "service": "Presence"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49842	13.232.67.198	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:32 UTC	340	OUT	GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=12389298-6ae7-4f15-9ea9-0fb4b2954121&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:16:33 UTC	277	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:33 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 45 Connection: close Cache-Control: no-cache Access-Control-Allow-Methods: GET Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:33 UTC	45	IN	Data Raw: 7b 22 74 22 3a 7b 22 74 22 3a 22 31 37 33 33 39 39 38 35 38 31 35 36 36 35 36 34 30 22 2c 22 72 22 3a 33 31 7d 2c 22 6d 22 3a 5b 5d 7d Data Ascii: {"t":{"t":"17339985815665640","r":31},"m":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49853	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:35 UTC	362	OUT	GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=4018a521-97a9-4c1a-8864-3e5ce86fb0b4&tr=31&tt=17339985815665640&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:16:36 UTC	279	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:36 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 7658 Connection: close Cache-Control: no-cache Access-Control-Allow-Methods: GET Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:36 UTC	4101	IN	Data Raw: 7b 22 74 22 3a 7b 22 74 22 3a 22 31 37 33 33 39 39 38 35 39 34 38 34 38 33 35 33 35 22 2c 22 72 22 3a 33 31 7d 2c 22 6d 22 3a 5b 7b 22 61 22 3a 22 32 22 2c 22 66 22 3a 30 2c 22 69 22 3a 22 61 62 39 35 62 66 30 32 2d 64 66 33 64 2d 34 63 63 62 2d 61 35 34 62 2d 34 64 32 38 61 38 39 61 39 65 62 63 22 2c 22 70 22 3a 7b 22 74 22 3a 22 31 37 33 33 39 39 38 35 39 34 30 35 38 35 32 30 32 22 2c 22 72 22 3a 34 32 7d 2c 22 6b 22 3a 22 73 75 62 2d 63 2d 61 30 32 63 65 63 61 38 2d 61 39 35 38 2d 31 31 65 35 2d 62 64 38 63 2d 30 36 31 39 66 38 39 34 35 61 34 66 22 2c 22 63 22 3a 22 31 34 32 31 36 66 61 36 2d 64 63 31 35 2d 34 35 31 39 2d 61 63 66 39 2d 66 30 65 31 62 33 34 39 35 34 62 36 22 2c 22 64 22 3a 7b 22 43 6f 6d 6d 61 6e 64 49 64 22 3a 22 64 64 39 39 35 37 33 Data Ascii: {"t":{"t":"17339985948483535","r":31},"m":[{"a":"2","f":0,"i":"ab95bf02-df3d-4ccb-a54b-4d28a89a9ebc","p":{"t":"17339985940585202","r":42},"k":"sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f","c":"14216fa6-dc15-4519-acf9-f0e1b34954b6","d":{"CommandId":"dd99573
2024-12-12 10:16:36 UTC	3557	IN	Data Raw: 2f 41 67 65 6e 74 50 61 63 6b 61 67 65 53 54 52 65 6d 6f 74 65 2e 7a 69 70 5c 75 30 30 32 32 2c 5c 75 30 30 32 32 69 6e 73 74 61 6c 6c 20 65 79 4a 53 62 57 31 44 62 32 52 6c 49 6a 6f 69 61 46 70 44 52 45 5a 51 61 45 73 33 4e 57 31 4b 49 69 77 69 55 6d 56 78 64 57 56 7a 64 46 42 6c 63 6d 31 70 63 33 4e 70 62 32 35 50 63 48 52 70 62 32 34 69 4f 6d 35 31 62 47 77 73 49 6c 4a 6c 63 58 56 70 63 6d 56 51 59 58 4e 7a 64 32 39 79 5a 45 39 77 64 47 6c 76 62 69 49 36 62 6e 56 73 62 43 77 69 55 47 46 7a 63 33 64 76 63 6d 51 69 4f 6d 35 31 62 47 78 39 5c 75 30 30 32 32 5d 22 2c 22 43 6f 6d 6d 61 6e 64 22 3a 22 72 75 6e 5f 70 61 63 6b 61 67 65 5f 70 61 73 73 77 6f 72 64 22 2c 22 44 6f 74 4e 65 74 34 35 50 61 63 6b 61 67 65 56 65 72 73 69 6f 6e 22 3a 22 32 34 2e 33 22 Data Ascii: /AgentPackageSTRemote.zip\u0022,\u0022install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOm51bGwsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9\u0022]","Command":"run_package_password","DotNet45PackageVersion":"24.3"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49852	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:35 UTC	159	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=ad3557e3-084c-48ee-bd6c-1cfa8c684d4e&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com
2024-12-12 10:16:36 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:36 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:36 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 35 39 36 30 37 36 32 32 30 36 5d Data Ascii: [17339985960762206]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49860	52.222.144.9	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:37 UTC	200	OUT	GET /agentpackagesnet45/AgentPackageMonitoring/37.8/AgentPackageMonitoring.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1 Host: ps.atera.com Connection: Keep-Alive
2024-12-12 10:16:37 UTC	672	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 3585766 Connection: close Content-MD5: 4BDR9hSxqDBILT30ugVvJA== Last-Modified: Mon, 30 Sep 2024 06:52:37 GMT Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 41ddddaf-d01e-001c-1ba9-4a2faa000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Thu, 12 Dec 2024 02:20:15 GMT ETag: 0x8DCE11C78816ACF Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5f65ac90cb02aca3a5a0a2a19c3c6812.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MRS52-C2 X-Amz-Cf-Id: AaH8ABcAZlNoBlWawOOAb92xhRIdwhv4-gGkQbQOpbz8lBeGk6m6zg== Age: 28743
2024-12-12 10:16:37 UTC	15712	IN	Data Raw: 50 4b 03 04 2d 00 09 08 08 00 8e 36 3e 59 ef 5e f5 53 ff ff ff ff ff ff ff ff 31 00 14 00 41 67 65 6e 74 50 61 63 6b 61 67 65 4d 6f 6e 69 74 6f 72 69 6e 67 2f 41 67 65 6e 74 50 61 63 6b 61 67 65 4d 6f 6e 69 74 6f 72 69 6e 67 2e 65 78 65 01 00 10 00 30 14 06 00 00 00 00 00 1b 70 02 00 00 00 00 00 cc 90 08 5f 4c a3 00 10 08 0f e3 bb 9e 8d f4 76 cd 77 1d e6 ea 9d 2f c8 45 07 12 6c 31 05 3d c3 38 ab 8e 46 16 04 d0 d3 0d 7c fb f0 25 4a e6 bd 9f c1 1f e3 06 51 42 13 87 2b d1 43 23 f0 28 01 1c 8e 59 f9 ca 2a 46 43 81 6a 99 2f f9 3f 0b 13 23 57 4a 82 54 f4 0f fa d8 d9 09 33 b8 50 b6 00 c9 b5 8d 37 5e 70 35 d8 67 bb 60 1a a5 20 c5 6d c9 68 1b 1b 55 f1 d0 28 5c a1 4f 6c 43 af 55 cd 81 df d2 2c 1d f8 8c 6c 7e e7 00 4e 6f 68 95 71 9f c2 8c 8a f5 41 69 fa 27 1a 45 75 Data Ascii: PK-6>Y^S1AgentPackageMonitoring/AgentPackageMonitoring.exe0p_Lvw/El1=8F\|%JQB+C#(Y*FCj/?#WJT3P7^p5g` mhU(\OlCU,l~NohqAi'Eu
2024-12-12 10:16:37 UTC	16384	IN	Data Raw: af 9f e2 83 de a4 ae 80 e9 81 be 40 5f ec d7 ca f4 34 6c 15 4a 5b 14 80 20 bc 6b d3 0c 3e a7 63 9b 4d a9 64 b0 c0 f4 66 5e 77 57 39 ce 52 88 b0 dd bd bb a4 6a bf ab 16 9d 76 4c f0 f1 55 55 78 d8 b9 13 e1 7e c8 9e 9c c6 ab ff cb 69 a1 a2 bd 61 fd 15 61 6e f0 9e 44 37 65 d4 7f c3 b6 f2 b4 cb 1c 18 4c c1 57 a9 31 08 a5 7c 91 ab 68 aa f7 c1 aa 86 1b a8 25 ca 5e b9 42 27 15 3e d6 8a 91 49 2c a7 9c 62 56 c4 51 24 2a 3a c1 a0 6e 53 79 10 ab ac 84 e0 4f f6 16 96 4f c7 2e 7e 49 5d f3 01 30 0c 7d 95 d6 c8 71 90 11 bc 8f a7 7a 6e 86 25 be 17 1c 83 2b f1 5e 40 f8 67 23 6f 11 36 7b ba 4d 3e 1b bd 32 41 a2 4f 14 a8 c7 2d 6e e1 77 8c 82 85 48 47 00 13 b7 ab cb 59 16 7e 2a cf f7 8b 5f 1d b5 29 e3 7a b4 ec 23 18 af 2c 35 b9 3c b6 6a a8 df b9 ee 1a 11 03 47 2a 36 8d 55 c3 Data Ascii: @_4lJ[ k>cMdf^wW9RjvLUUx~iaanD7eLW1\|h%^B'>I,bVQ$:nSyOO.~I]0}qzn%+^@g#o6{M>2AO-nwHGY~_)z#,5<jG*6U
2024-12-12 10:16:37 UTC	16384	IN	Data Raw: 03 02 36 50 0a 92 ee 6b 4b b9 9b 28 66 ce 8f 70 fb 78 93 44 72 e9 40 30 b7 b8 01 0d 39 ea eb 75 30 17 3e 39 3a a3 c6 45 a2 3d 54 65 7a 88 36 b4 9e 80 b1 04 13 7a e9 b1 e4 08 9b 23 ae 83 f6 2b b4 12 3b c0 7e 8f a7 69 c5 45 da a0 df be c6 ec 1d c1 6c e3 67 c8 fb c4 54 81 a9 2d 7a 54 09 d2 cd 3a 9f 05 e5 c0 77 eb cb f1 6a 59 00 e8 81 b5 63 90 05 03 4e bb 6e 9f 92 d2 98 d2 d1 f7 22 72 eb c1 84 6e 2b a9 02 2c fb 10 a7 91 93 9f ca f2 ad 4c 43 1c 7e 1c 16 c8 12 41 1e 68 74 c9 f0 f0 ad e9 1a 6c f8 3f 89 b2 96 ad f7 22 93 06 50 80 6d 77 db 9f 84 70 6b dd a5 86 9e c0 63 30 50 73 e9 06 15 b7 ed 04 73 6d 66 64 05 c6 03 7d 3c 61 7c 1f 44 f7 af 46 9a e7 cf 09 b0 8f aa d6 c7 19 93 57 55 0a 14 21 6c 98 b4 69 22 57 e3 e2 a6 9f d0 33 7d 0a c7 f3 a2 fd 20 5f 57 8e 32 cc 43 Data Ascii: 6PkK(fpxDr@09u0>9:E=Tez6z#+;~iElgT-zT:wjYcNn"rn+,LC~Ahtl?"Pmwpkc0Pssmfd}<a\|DFWU!li"W3} _W2C
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: a7 26 82 1a 54 1a 0a b6 a5 58 40 6d 62 be 47 8f b2 89 bc 92 8c 9b 94 c0 c6 85 98 1a 80 26 00 80 1e 70 04 89 c2 3e 81 9f 5b 8a 3b e6 b0 f8 b8 e0 f6 19 78 31 e0 55 82 a2 5b 91 fa 9a 82 89 c1 6c b7 4f 1e 1a be 65 58 df 2b 7c 01 32 e5 57 70 23 10 43 59 a3 f6 44 ee 83 b5 18 97 62 d6 98 14 ce 9d 29 91 47 e9 42 32 31 8e 62 5e f0 35 73 16 e9 7f 99 54 d7 1e 3e 03 79 b8 f0 8f 9b ea c5 c4 4f 9e 28 8d 4a f0 df 8f 48 d2 7d 7f fd 1a 77 ae 4d e5 e1 e6 6b 5c 1e 6f e2 b9 29 0f a1 79 7a 96 89 05 83 c7 28 13 1f 88 48 41 b8 d9 fd 74 16 1d 27 7c 28 76 0b ef 68 67 bf e1 dd 17 d4 c1 b0 11 ea a7 bc a1 b5 d5 24 4e 0f d6 ea fb d1 b0 f5 6e 4c 77 6d 50 bc 35 a3 44 a2 da 46 06 13 46 39 7a 66 16 b9 22 ac 00 8f f9 89 88 51 e0 b6 fb 28 e1 ef 1c a9 6d 29 01 05 6b 38 80 58 99 13 e0 bf 08 Data Ascii: &TX@mbG&p>[;x1U[lOeX+\|2Wp#CYDb)GB21b^5sT>yO(JH}wMk\o)yz(HAt'\|(vhg$NnLwmP5DFF9zf"Q(m)k8X
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: cf 5b e5 b7 41 5d 4e b8 bd e0 d2 54 95 60 d0 01 11 9a 38 61 7d 41 75 62 2e 2f 42 56 71 c5 c4 bf 1e 74 14 b6 93 06 49 ef 44 e8 99 67 43 c0 c0 50 0d 9a c5 12 b4 85 be 3d ab b7 89 20 8c 96 44 be c0 49 18 3a a0 d5 6b f8 f8 94 5f c7 63 74 87 05 98 18 06 10 3e 0c ce 70 5a 43 2b 2d a9 24 69 4d 90 bc b9 ec 27 21 c4 21 f1 d5 9d 24 2b 8f f1 60 ce 6e cc 2e a0 64 96 91 f3 36 05 36 05 cf d9 85 f9 9d 8a 4c 6e a4 f9 06 68 9d 0c 17 6a d4 9d b3 f5 0b 69 78 83 f0 1a 53 3f 17 6e 94 17 80 01 85 18 3b 83 d4 f4 5c b4 d5 14 b2 2c 61 a6 83 6b bb f1 c7 d5 ea d7 4e ed e0 0e 4a ca 8a 32 32 73 e5 65 d3 20 83 31 6b 6f e3 ae 22 b7 d2 7e 8d d9 4e 62 23 c8 82 71 6d e8 e1 2a 10 f3 74 8b 49 0e 20 07 0b 0f 01 bd 02 4b 1f 97 d0 bb 13 2c 19 0d 73 ad d8 4c 08 6e 48 6c 53 7c 1a 55 5f 05 20 f3 Data Ascii: [A]NT`8a}Aub./BVqtIDgCP= DI:k_ct>pZC+-$iM'!!$+`n.d66LnhjixS?n;\,akNJ22se 1ko"~Nb#qm*tI K,sLnHlS\|U_
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: 81 87 d2 a3 86 35 61 95 e3 e2 20 d7 d9 91 b5 1e 8c 10 50 e7 a5 ba 75 20 da 1e e9 21 c3 ef ba a3 d5 ca 69 0a fc cb 22 09 ae f1 09 c6 6c 4c 76 44 30 c3 3c 3b 0b 51 1e 58 e9 c1 bd 5f ce 9e 18 9f 63 14 25 c1 6b 86 65 80 1e 4f 51 a3 4d ee 5b ce cd 2e d6 4b 48 1f d6 68 94 d1 4b fc 85 63 96 f4 cc dc aa cf 61 cb 23 92 1b 0d d8 a1 80 bc b3 6f 4a b8 b2 36 0f 5a 0e ec 38 04 38 fe 77 72 18 4b f6 c4 f8 a1 86 85 fe 81 1d da 77 6b 9e d2 aa 43 18 b8 88 03 16 51 51 04 a9 40 e6 dc 8f f2 1e 4c 83 6b 5d 90 04 53 a6 68 f7 d5 d1 e4 25 db 44 ae cc 02 7c 2f 75 c6 ba b6 e0 fb 8f c9 bb 2a 5d 22 cd c5 60 d6 00 bc c6 9b 88 29 2e 9a 86 54 6c fc 3f 2d da 6b a4 63 e6 e5 60 31 f1 8a 7c 87 8f 56 65 a9 77 25 eb 2e 33 ab 9c f4 d4 75 eb 4a 2b a0 49 e3 0f e1 74 49 ae 7f 4a 51 41 c9 1d 22 2b Data Ascii: 5a Pu !i"lLvD0<;QX_c%keOQM[.KHhKca#oJ6Z88wrKwkCQQ@Lk]Sh%D\|/u*]"`).Tl?-kc`1\|Vew%.3uJ+ItIJQA"+
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: 23 c0 39 76 32 27 91 ae 6a 7f b0 df 5c 1c 19 21 6a 0a 22 fa 2e 0a 7f 58 10 ba 80 28 a8 b3 1d b5 67 ec b6 e5 82 57 d5 8d 18 bd 28 10 b5 3b 8d 6f e6 fd 6b 81 16 d6 2d d8 5c e3 69 67 df 45 d7 5d a4 8f 2d bd 30 61 de 01 75 43 da cd 98 7f b7 b6 8a b9 0d 58 5a 43 a9 6e c8 bb 91 a7 07 05 e6 8c d7 ed 0f 06 69 8c e7 20 86 1c c9 91 ee 35 ed a6 38 9f d5 06 37 93 ff 23 68 f4 78 81 5c 82 98 62 ea 9e c5 b2 02 c6 e7 22 fc 42 07 83 9a 98 26 0a dc c5 54 95 cf 5e 13 15 23 45 a8 40 ab 89 28 0c 42 8d b8 3c 9d 97 87 46 9f a0 bc 2c 50 4e 88 d3 ad 9e a2 6e d4 8c f7 c4 fb 25 c9 bb d7 40 65 9e 79 7b 19 77 5a b8 45 4e 27 fd 82 73 5c 42 26 c7 74 3b 83 d3 e8 51 af 90 8e a1 e2 18 50 fc 4c 16 ff 16 f9 a8 59 b4 db 92 75 37 78 f5 50 fc e4 7a 9a d8 39 bb fd 7e 41 bf f3 01 20 81 78 16 a5 Data Ascii: #9v2'j\!j".X(gW(;ok-\igE]-0auCXZCni 587#hx\b"B&T^#E@(B<F,PNn%@ey{wZEN's\B&t;QPLYu7xPz9~A x
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: 8b 8a e9 be 78 82 f4 81 d4 88 ca 52 79 60 fd 3b 45 b8 ee 35 17 ec 42 2d 7f 4c 17 7c 54 67 51 46 27 2d 0e 96 cb 3c 68 5c 57 da 25 87 80 7d db b6 20 7e ef 3d 3e d6 2b 1f 0b c3 50 b5 02 0d 61 ce d5 e4 64 ac 10 fa 63 2b 3c 7f b8 f9 af 6c c6 52 0d 7e 4d 7c 1f d5 52 28 0c 84 f8 a5 b9 f2 03 ab 02 66 02 c6 70 ce 8c 56 fa d5 b3 d5 22 69 c9 68 b8 14 b9 0e 99 5d 50 de 54 5e a2 58 a5 a7 ea e9 0e b5 a4 d4 6c 1b cc 38 6f 33 09 4f 44 7f d4 9a f9 c0 96 37 5f 80 e1 36 1c c9 f8 1c 30 86 d6 69 ba 06 26 ad f6 41 5e 8c 8b 23 51 e5 8a 5a 8c 42 94 71 16 53 c0 dd 33 58 21 51 a7 74 62 17 79 29 31 41 9a 8e 1f dc 7d 13 51 29 0f 05 aa 86 df 89 75 c4 dc 06 32 50 71 63 72 24 30 56 4c 5e 96 71 06 d2 a6 7f d0 60 71 2b ae 8f b2 b7 f0 cb d3 a4 e2 71 9d dd ba 5e 3a 1b b7 5f 72 7c f3 2c fa Data Ascii: xRy`;E5B-L\|TgQF'-<h\W%} ~=>+Padc+<lR~M\|R(fpV"ih]PT^Xl8o3OD7_60i&A^#QZBqS3X!Qtby)1A}Q)u2Pqcr$0VL^q`q+q^:_r\|,
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: 15 48 c4 78 19 de d0 93 9a ae b2 e8 ed 15 16 ef 86 ad bd ef eb 14 49 7e 64 ba bc 80 a2 d0 b0 6b 8b 44 49 4b 50 9e 49 64 0c 3e c4 4f d2 f6 51 d7 e7 03 81 d5 b6 5f e3 08 1e 24 0e 8a bd 3a 51 4b 47 40 a2 f4 32 7b cd 61 66 7f 82 ef df 22 3e 1b bc 93 ae ea bd 03 90 e2 3a da a2 ff 34 d8 b6 10 03 7f 5f 4d 1d 86 0a 66 15 87 54 70 50 9b a8 57 8d 2d c3 95 2a df 8a e6 c7 9a 45 3c 55 85 87 eb 68 78 2a 83 35 97 ed 5c ab b6 dd 46 ed fe 6c d7 1a 1c 58 84 4a 71 22 6b c9 9f 36 2e 22 31 0d 7c ca e2 03 9f 58 80 3c c1 2e ac 7d 4d e4 e5 0d 0f cd 67 fb 79 15 e5 3e f4 be 50 7b 4b 05 22 44 fd 07 7e dc 23 f0 5e 05 dd 98 08 dc 6e a8 6e 32 e4 b4 6e 23 ff 70 e2 70 40 88 a6 38 a4 81 74 72 8a 45 bb 87 b0 bf 01 e8 84 d0 04 c6 bf bb 2b 9d b6 ee 1b 03 fc bf 6d 17 a6 95 6b 19 14 44 d9 4e Data Ascii: HxI~dkDIKPId>OQ_$:QKG@2{af">:4_MfTpPW-E<Uhx5\FlXJq"k6."1\|X<.}Mgy>P{K"D~#^nn2n#pp@8trE+mkDN
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: 6a d1 69 87 62 40 f2 a7 b2 0c a4 5f 3c c0 90 dd 78 de 38 b8 a5 1f 4c b5 60 af 0a 35 23 39 83 43 26 f0 c3 0a 74 4b b8 03 04 98 9a e6 0e 6b 76 98 ea 6b 27 e0 4a 16 ba a6 aa 24 0a 14 3a 00 72 f9 0d 72 9d 81 34 58 f7 6f bf 3b fd 07 40 01 35 aa 22 d2 b8 4c b7 28 94 2e 83 86 73 9a 57 16 c4 ec 4a 06 c1 47 e6 b8 62 b8 3a 56 ec 35 0f 10 ca 08 ac 8f 8b 09 49 1f 87 aa 00 dd 81 14 1c 78 94 80 a6 90 19 13 f5 a1 98 94 b2 3b 8d 2c 72 29 aa 3f 05 ca dc 11 bf fa 68 e6 32 b9 5b 2c 86 1d a9 c4 ea 21 a9 69 4d eb fa ae 21 83 ae cb 73 94 29 0e b0 74 69 97 27 db 62 ce f5 65 56 76 90 f9 1e df 76 9a 1c 6c 3c 60 4c b6 2c df 89 f0 83 2e b3 f9 a5 2f 90 7a ab 27 57 13 8a e9 24 9e 7d 58 8c 52 68 a2 38 2e 24 26 b5 a2 83 f5 45 2a c4 4a ad 2f c4 41 8e d9 13 7b 3b b1 1d df c3 5c 7b cb be Data Ascii: jib@_<x8L`5#9C&tKkvk'J$:rr4Xo;@5"L(.sWJGb:V5Ix;,r)?h2[,!iM!s)ti'beVvvl<`L,./z'W$}XRh8.$&E*J/A{;\{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49863	52.222.144.9	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:37 UTC	196	OUT	GET /agentpackagesnet45/AgentPackageSTRemote/24.3/AgentPackageSTRemote.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1 Host: ps.atera.com Connection: Keep-Alive
2024-12-12 10:16:38 UTC	671	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 342316 Connection: close Content-MD5: CUR/E19/RIbBZQYc9EPFaQ== Last-Modified: Wed, 04 Dec 2024 08:33:14 GMT Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: c27f0a84-301e-002b-45b7-4afd06000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Thu, 12 Dec 2024 04:00:27 GMT ETag: 0x8DD143E4B4829B9 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 7277af1f0e97793d2cf0976629e553ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MRS52-C2 X-Amz-Cf-Id: WsaE9aLbKYhFBCx-Wcc4KBQOIqP6WXMWSksPR0-lqFI2SyccwthNCQ== Age: 22684
2024-12-12 10:16:38 UTC	15713	IN	Data Raw: 50 4b 03 04 2d 00 09 08 08 00 23 44 84 59 83 56 a7 3a ff ff ff ff ff ff ff ff 2d 00 14 00 41 67 65 6e 74 50 61 63 6b 61 67 65 53 54 52 65 6d 6f 74 65 2f 41 67 65 6e 74 50 61 63 6b 61 67 65 53 54 52 65 6d 6f 74 65 2e 65 78 65 01 00 10 00 28 1c 01 00 00 00 00 00 da 6d 00 00 00 00 00 00 7e e7 3b 38 77 d2 38 c8 fe d4 4e 00 b2 fe c7 de 5d b9 9a 7a d9 e1 31 06 6f ed a0 3f 87 ae ed dc 90 da 2e 91 bd 13 b2 fb 96 a8 62 8e 16 ed 54 c7 1e 2a be 96 f1 9f aa f7 be 57 db 11 80 84 da 85 9e 76 ea 0e bd 12 2c c5 33 ae 3c 7e f4 40 dd 55 f0 df 1c 46 5d c9 da d6 92 d5 8c 6f 43 6f 0c c9 61 88 fe 64 52 ef b0 a3 01 eb ac 16 c0 d5 51 2e 2b ed 80 a3 51 2b f7 23 42 00 f1 37 ee b5 9e 5c a1 40 80 3e 6f bb 3b d4 09 4a 37 77 64 9b bc 04 0a df de c4 b3 03 48 b9 d1 ef 6d 1c 47 2f 0c 5e Data Ascii: PK-#DYV:-AgentPackageSTRemote/AgentPackageSTRemote.exe(m~;8w8N]z1o?.bT*Wv,3<~@UF]oCoadRQ.+Q+#B7\@>o;J7wdHmG/^
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: e1 f6 ff 90 d0 bc 33 f3 59 b9 be e8 97 15 2a 8b a5 a9 ef d3 0c 51 45 16 17 eb 12 26 be 97 1e f2 95 09 46 71 e6 98 b7 00 97 27 d3 9b 5c f1 19 40 e3 9a e5 cf 32 4d 19 d2 8c 62 1b f8 38 c9 03 56 fe ae 04 44 47 b8 48 5c 09 46 96 4d 06 71 99 e1 a9 23 10 81 0d 4a f6 92 73 1d b7 b9 b6 12 e2 f4 dd 9c 43 fa 20 d0 9d c5 23 f7 fb a6 18 d7 10 6f d7 e9 ae 97 c9 c1 8e 44 55 aa 2b 68 fc 52 99 54 cb bf 90 98 d8 75 ad f6 ca 6d 8f c5 9f 77 20 c3 b9 1b d2 f2 b3 c0 00 28 fa f2 db d6 f6 fc 24 5c 83 2f 3a bc 4b c2 cd 88 12 ba 10 fb f6 41 7d ee a9 43 8d 2a aa 02 c7 0f 46 2c d9 e9 4a 90 5b 40 58 de 8a e8 fa 34 e1 58 3f 6d 23 8f f0 97 32 bd b2 e4 7e 7c 71 0a f0 80 53 96 f6 05 be 40 c4 2a 01 67 9c e1 5f 42 1b 8e f0 5d de 44 56 f5 37 96 b4 c1 c7 9f 07 3c 7f 1d 4c 28 84 ae b1 f9 90 Data Ascii: 3YQE&Fq'\@2Mb8VDGH\FMq#JsC #oDU+hRTumw ($\/:KA}CF,J[@X4X?m#2~\|qS@*g_B]DV7<L(
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: 1c 76 c2 e5 41 39 1c 1d 0d 08 f9 3f 8f b7 f7 3d 85 59 19 0d 68 7e bf 6c 88 8d d2 d4 f4 85 fe fd 16 b4 d9 ed 0a be 59 f4 ca 1e 23 81 43 fb 1e d0 2b 58 cc b2 eb 25 58 6b 7f 26 2c 9a 85 0c 36 be 59 aa c0 bb a2 96 69 d6 ea 40 77 9f 62 b8 a9 a3 41 7c 4b bb a4 ca 48 23 3f b7 12 2a fb 90 af 1a fa 58 3b a5 29 dd a2 5f da 6a 6c 48 42 5b d0 17 d2 2e a0 d3 30 0b 32 6f 41 10 7a a3 bb 04 6d d4 54 8f 3f ea 77 43 f8 ed a8 21 c7 3e 83 76 23 fe c2 20 df 5a df 77 98 57 c9 e0 bd a3 bb 9d bc 37 fb 78 5a 13 c6 b6 b9 a8 69 55 e0 94 17 ed 15 99 45 1c ac d6 61 dd 22 d6 7b e0 1b f8 86 d5 58 11 77 0f 92 f0 4b 22 ee 22 27 63 b4 9c fe 8a a6 d4 d2 b6 cd 23 2b e1 f5 74 b5 a1 fe 20 4f 77 b6 0a af f3 23 86 06 6d 80 85 a7 6b cd 92 be b2 58 54 4b d6 cf 46 69 6a f1 83 25 9c a4 87 b4 5c ba Data Ascii: vA9?=Yh~lY#C+X%Xk&,6Yi@wbA\|KH#?*X;)_jlHB[.02oAzmT?wC!>v# ZwW7xZiUEa"{XwK""'c#+t Ow#mkXTKFij%\
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: 83 df 5f eb 17 73 e0 aa 8c 65 0e 06 5a 9e 53 89 29 b0 56 ec a7 71 2f 2b 07 bb ac 72 fa 1a 2a 3c b5 cc 91 8e 35 fb 76 42 2a 7a 3f 73 bd 84 42 cf 5a 22 1e 40 3b e9 81 8e 28 e8 53 79 0d c1 68 dd 57 7d 8f 4c 1a 03 71 46 73 ca 75 40 56 94 70 17 77 24 8f 95 9c d2 3e aa 0e 5a 08 75 08 d3 07 58 af 0c 16 d5 59 ec c9 ca 9e f5 fc 5e 62 74 d9 0c d4 a3 2f e1 fe c7 ff 54 52 20 46 f7 3d d7 f7 af 4a f9 57 c1 eb a7 aa a5 ea e3 b6 9b 6b 4d 74 6f c1 c3 0e 26 1d 88 0b 2e 27 a3 eb 36 c0 a3 01 f3 9e 2a 12 49 b2 0b 77 d7 cf 61 3d 7d 77 f1 e7 76 ca 53 93 4f 40 20 2d 0d 69 e9 53 f1 25 00 96 e0 e7 fa 2f 44 98 41 c1 4a f3 ca 55 8e a9 94 f9 92 1a 6a 4e 3f a4 73 97 55 8c 5b 88 99 b2 6f cb 36 d4 99 df f3 f0 f3 aa b7 f0 75 25 d9 81 6e 40 69 1f db d3 65 a2 a1 85 83 dc 41 5e 23 55 8b d6 Data Ascii: _seZS)Vq/+r<5vBz?sBZ"@;(SyhW}LqFsu@Vpw$>ZuXY^bt/TR F=JWkMto&.'6*Iwa=}wvSO@ -iS%/DAJUjN?sU[o6u%n@ieA^#U
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: e9 96 d4 78 1e 7f 4e 2e 9b 33 84 35 60 19 b3 fc 61 a6 05 0e d7 b7 e7 c1 67 dd 70 a8 de 1b b1 f1 db d0 03 01 ab a2 0c 29 9f 2f 1e 6a 52 58 80 6e 89 c5 3e fe 12 76 45 41 35 87 5b 35 72 e5 a9 e1 b0 ce 2b cc 7e 90 76 41 26 e7 3d 9f 9f 5e dc 3d 5c f4 8a 77 42 60 20 ba 1c 6e e2 d3 a3 aa e9 0c 80 a8 36 38 fb 2a 86 ed 22 70 58 4b 6f c5 e9 1e fa ab 5d 91 ba 97 61 00 21 7b 37 f9 f7 41 f5 17 5d 3b 43 f6 50 de f2 29 c0 b5 35 b6 73 d3 51 18 71 04 fc 55 2c 58 b1 4e a0 09 27 d6 0c f4 60 4f 7b 91 85 95 69 23 c4 4f 8c 41 24 e2 6b b7 90 b3 a7 0d 38 9f ea a3 a9 43 2b 77 af 0d ef 92 b6 46 fe a7 53 69 08 03 da 16 89 00 8b f8 28 00 1c 4f 07 4c e5 1e de e9 9d 90 94 92 cd f1 53 31 a5 33 4e 56 11 1c 7e 41 1e be 5c 0d 8a 06 44 34 8c 43 e4 3d 52 2e 98 1e 2c 76 0c 9e 87 30 61 be bb Data Ascii: xN.35`agp)/jRXn>vEA5[5r+~vA&=^=\wB` n68*"pXKo]a!{7A];CP)5sQqU,XN'`O{i#OA$k8C+wFSi(OLS13NV~A\D4C=R.,v0a
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: 0a ff b4 14 ae 56 04 02 cd bf f1 bc cc a3 74 89 8f a3 c6 32 87 56 81 6d 6f bf 57 b5 d9 ef 9b 4c 24 9a 27 3e f2 8d b8 05 1a df df 2e d4 9e bc 95 ab c3 93 bf 76 e5 58 c3 cd 51 11 82 dc 9a 16 a3 ed 0a 0c b7 74 32 6e fb 4e 3b b9 a6 04 9e 21 1c f1 70 ef 2b 31 02 57 f8 27 9a ce 89 e3 d6 83 fc 03 55 3e 0b 09 3f 20 d2 8b a7 96 62 d8 2c 2c 69 ad 00 6d 46 75 ce bd a7 d0 77 f9 a5 c6 4d d0 66 0c fc ad 6c 5e d0 ab 1e 05 00 ce 73 b6 a7 01 59 d9 cc c1 45 40 e2 5c a2 cb 79 44 c3 60 41 8f da ae 76 96 1d a1 53 9b ba 7d b6 fc 5b d5 98 73 1a d2 11 da 0d 7d 32 74 03 ae 74 3a 78 53 48 d4 bb 21 51 cf 03 cf 27 93 e8 c2 70 46 0b c6 28 32 16 bb 4b 66 b2 21 b8 f7 df 41 ff 8d cf d4 50 3f fe 22 d2 84 c8 8a 51 02 46 af 2f 29 58 a8 0d bc a8 3b 5b ce 10 df f7 8e 66 a9 60 74 91 68 e1 28 Data Ascii: Vt2VmoWL$'>.vXQt2nN;!p+1W'U>? b,,imFuwMfl^sYE@\yD`AvS}[s}2tt:xSH!Q'pF(2Kf!AP?"QF/)X;[f`th(
2024-12-12 10:16:38 UTC	16384	IN	Data Raw: 9d ea 47 6b 56 76 7a c9 38 8b 67 68 03 44 99 b6 ca 54 59 d4 d6 67 34 65 c4 c0 9d 54 d3 f3 6f 3a 7b 9a 80 a5 9d 07 73 57 a3 44 90 2c b0 8d 94 b1 c4 ec 48 99 9c cb d3 1c 05 2f a0 76 4c d1 62 e7 e5 10 69 8f ad 90 e3 e6 e7 b3 f6 1f aa 05 a0 d6 96 e3 97 5e 13 d9 73 97 80 53 c2 a1 81 e0 5e 0e 3e 16 3d 36 5a 6e 73 5e ce de 71 f0 ce 94 90 cf 6f e6 3e 10 72 61 8a e2 d5 ae d5 af d7 47 d6 7f 57 db 25 54 61 00 d0 bd c2 f8 be 37 b8 e1 7b 07 aa 0a a6 b5 da c9 a7 34 0a d0 3e 5d af be 86 0e 45 46 73 ae e5 9e 90 2c 66 00 3e 58 e8 60 16 53 af 33 ef 5b aa 07 be 8c 44 c7 4a 7d 03 f4 69 d0 e9 68 c9 e5 8f 3f 78 af 8d 4c df 3d 74 3f a7 92 9a 0e ce 24 d7 1d 56 f5 6c e8 e5 c0 fd 9c 28 3b ee f4 5f f5 aa 51 1c 47 37 11 85 54 49 c5 f8 00 28 c7 10 51 28 f5 a6 ad 08 9f ce 4c 91 0d 7a Data Ascii: GkVvz8ghDTYg4eTo:{sWD,H/vLbi^sS^>=6Zns^qo>raGW%Ta7{4>]EFs,f>X`S3[DJ}ih?xL=t?$Vl(;_QG7TI(Q(Lz
2024-12-12 10:16:39 UTC	16384	IN	Data Raw: 4d c4 20 92 fc ac a9 da d5 62 81 cb 88 8e 9f f0 93 cc 5e e4 2d 05 7a b1 8c 3c ea 50 8e 1d f0 c1 84 51 83 7b 57 18 e2 b4 34 b2 25 8c 4f e9 9c c6 39 2c 5d f4 3e b7 fd e4 fa 73 f2 3d 2a a2 ac 62 69 8c 7e 1a a1 1c c8 79 b7 3f 25 f7 f6 2d b0 6d 88 4a ef c7 6d bc 67 b3 a8 e2 32 1d e0 7c 93 43 68 82 6d 8d c2 71 e3 05 27 a0 2a 4e d4 4d 13 1d a4 cf 83 a4 d7 19 b6 58 f6 c5 50 19 15 70 56 bc 06 3e 72 59 f6 33 61 77 6c 9a c2 16 dd 59 a6 0c 32 1c a1 7c 25 7e 1d 1a c1 e3 9f 42 68 0e db de 9a 5d 83 0b 1e fa 8b c9 41 3b 49 64 1f dd 61 63 2a e0 b8 16 3b 97 4f 66 bf 23 2c 7d ed 76 28 0f 3a d7 06 7e 73 19 aa 23 10 da ef aa 24 49 e6 37 86 08 46 ea d5 65 a5 af c7 76 04 18 6f 8f 34 0b 2c ca 1d 06 ac d9 5b c0 71 e5 c0 09 d1 7d d4 65 90 eb 16 a4 e0 d6 b0 1e 24 82 a3 2b 29 21 53 Data Ascii: M b^-z<PQ{W4%O9,]>s=bi~y?%-mJmg2\|Chmq'NMXPpV>rY3awlY2\|%~Bh]A;Idac*;Of#,}v(:~s#$I7Fevo4,[q}e$+)!S
2024-12-12 10:16:39 UTC	16384	IN	Data Raw: 53 16 66 9b 28 85 db fa 32 7c 65 bd 77 2b 51 59 21 e1 6a 02 af 5c cf c6 d5 d4 8a bd 80 32 af 25 e6 db 84 d7 8a f5 73 a0 8d c7 ca 6e 40 42 82 d0 60 08 1b 54 e6 f3 b2 dc 0f 08 78 f5 95 ac 48 aa 00 47 3c ed fb 3e 09 b0 54 b2 40 a2 51 d2 d3 9c 6f 6c 53 2b bd 4d 28 c7 70 df 79 ab 92 20 65 d2 ec 88 55 62 e2 b1 6c c8 85 6f 35 3d 64 95 1b b6 f0 b7 7c 6b 7b 3e 75 ab 6a ea 89 6a aa af 25 f1 72 f7 94 7b 25 6e b7 58 83 b5 fd ce 4e cb f7 a7 60 06 89 7d c7 0e 1c b1 a1 8d 9e da d5 80 a9 81 9f 8e 2b e0 19 ca 01 c0 93 4c b6 1a 16 5e d5 75 e0 6c f9 28 0e ad f9 16 90 59 00 35 b3 e8 84 57 46 69 f2 e7 8e 69 63 15 c7 dd 84 9f 00 ad fa 26 be 94 b3 78 df 11 7f ba 05 a9 91 ce b0 88 f8 7e 86 fa e2 21 6d 21 b0 06 72 81 cd e8 be d7 bf 62 06 e0 f0 b8 7a 7c 02 f0 8b bf c7 25 f1 21 38 Data Ascii: Sf(2\|ew+QY!j\2%sn@B`TxHG<>T@QolS+M(py eUblo5=d\|k{>ujj%r{%nXN`}+L^ul(Y5WFiic&x~!m!rbz\|%!8
2024-12-12 10:16:39 UTC	16384	IN	Data Raw: 08 75 65 1f 6b 20 a9 fe b2 11 e9 67 db 32 92 19 53 9c 0c af e0 90 fb 8f 46 bd 9d 38 5e 5c 65 b8 d2 b7 6c 19 5c 9e e7 9d b6 c1 42 9e 0b 33 9e a2 e7 28 bf 84 0b 76 b0 d1 7d 72 fe 28 32 0d 68 8b 1f 6a 42 51 c6 1e 07 2e 48 37 c6 72 2b 00 04 3a c0 95 1b 6e 53 88 45 6c 3c 80 e9 dc 66 75 b7 14 9c a5 7d a3 52 3f c0 59 59 07 59 f0 40 5b fe 30 65 f5 9f 64 a1 39 ff f8 cb 8b d3 79 ff 99 97 f3 6e 63 00 82 ef e2 38 9f 10 a8 a1 83 1a 1d f1 d5 71 8e 62 4e 45 51 81 66 c6 0d cd 34 23 0a 74 86 54 36 96 f6 d5 54 d8 e3 1c 62 f2 3d 84 03 5b e1 53 f1 65 fb 90 6d f1 11 46 4d 89 ef 5f cc 00 c2 4d 1c 7b 05 fc 15 a1 d1 09 c3 a8 a8 af 11 31 91 73 26 75 78 43 4f c4 77 b2 98 94 14 b9 8b 75 e4 2e df 96 0c 7b f4 b2 6f 71 3f f4 0d b8 ee 96 95 6e 64 98 1b 93 fd 12 8d 9b 7c 86 fc 63 41 af Data Ascii: uek g2SF8^\el\B3(v}r(2hjBQ.H7r+:nSEl<fu}R?YYY@[0ed9ync8qbNEQf4#tT6Tb=[SemFM_M{1s&uxCOwu.{oq?nd\|cA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49864	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:38 UTC	159	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=aeeb8ccf-6cad-4f66-be18-8ce34441b247&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com
2024-12-12 10:16:39 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:38 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:39 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 35 39 38 39 36 31 32 38 35 31 5d Data Ascii: [17339985989612851]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49865	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:38 UTC	362	OUT	GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=fe41fefc-5f93-4d82-ae91-b2bfdba61e15&tr=31&tt=17339985948483535&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49874	13.232.67.198	443	6400	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:41 UTC	183	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=51a8a5d4-ca44-40cd-84d4-46bd929e2ce8&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com Connection: Keep-Alive
2024-12-12 10:16:41 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:41 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:41 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 36 30 31 35 33 37 36 33 35 39 5d Data Ascii: [17339986015376359]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49876	13.232.67.198	443	6400	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:41 UTC	364	OUT	GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=c49e3f86-ddea-4646-a660-d7eb89720c05&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com Connection: Keep-Alive
2024-12-12 10:16:41 UTC	277	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:41 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 45 Connection: close Cache-Control: no-cache Access-Control-Allow-Methods: GET Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:41 UTC	45	IN	Data Raw: 7b 22 74 22 3a 7b 22 74 22 3a 22 31 37 33 33 39 39 38 35 39 34 38 34 38 33 35 33 35 22 2c 22 72 22 3a 33 31 7d 2c 22 6d 22 3a 5b 5d 7d Data Ascii: {"t":{"t":"17339985948483535","r":31},"m":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49884	52.223.39.232	443	6516	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:42 UTC	74	OUT	GET /csrs/win HTTP/1.1 Host: my.splashtop.com Connection: Keep-Alive
2024-12-12 10:16:42 UTC	826	IN	HTTP/1.1 302 Found Date: Thu, 12 Dec 2024 10:16:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: Apache Cache-Control: no-store vary: Accept-Encoding,Origin Referrer-Policy: strict-origin-when-cross-origin X-Permitted-Cross-Domain-Policies: none Pragma: no-cache X-XSS-Protection: 1; mode=block X-Request-Id: 904d309e-ed04-474e-8a2b-9cce15b30660 X-Download-Options: noopen X-Runtime: 0.005913 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff x-rack-cors: miss; no-origin Expires: Fri, 01 Jan 1990 00:00:00 GMT Location: https://download.splashtop.com/csrs/Splashtop_Streamer_Win_DEPLOY_INSTALLER_v3.7.2.4.exe Status: 302 Found Strict-Transport-Security: max-age=31536000; includeSubDomains; Referrer-Policy: strict-origin-when-cross-origin
2024-12-12 10:16:42 UTC	160	IN	Data Raw: 39 61 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 59 6f 75 20 61 72 65 20 62 65 69 6e 67 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 73 70 6c 61 73 68 74 6f 70 2e 63 6f 6d 2f 63 73 72 73 2f 53 70 6c 61 73 68 74 6f 70 5f 53 74 72 65 61 6d 65 72 5f 57 69 6e 5f 44 45 50 4c 4f 59 5f 49 4e 53 54 41 4c 4c 45 52 5f 76 33 2e 37 2e 32 2e 34 2e 65 78 65 22 3e 72 65 64 69 72 65 63 74 65 64 3c 2f 61 3e 2e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 9a<html><body>You are being <a href="https://download.splashtop.com/csrs/Splashtop_Streamer_Win_DEPLOY_INSTALLER_v3.7.2.4.exe">redirected</a>.</body></html>
2024-12-12 10:16:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49893	13.232.67.198	443	6400	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:44 UTC	362	OUT	GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=7fbc5d09-98da-404d-b19a-f5bc553e8fdf&tr=31&tt=17339985948483535&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49892	13.232.67.198	443	6400	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:44 UTC	159	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=32512929-c9c1-4979-81c7-29f6282aeeb4&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com
2024-12-12 10:16:44 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:44 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:44 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 36 30 34 36 30 38 37 37 39 35 5d Data Ascii: [17339986046087795]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49896	13.227.8.66	443	6516	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:44 UTC	129	OUT	GET /csrs/Splashtop_Streamer_Win_DEPLOY_INSTALLER_v3.7.2.4.exe HTTP/1.1 Host: download.splashtop.com Connection: Keep-Alive
2024-12-12 10:16:46 UTC	512	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 56907920 Connection: close Last-Modified: Thu, 28 Nov 2024 06:35:04 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 12 Dec 2024 10:16:46 GMT ETag: "adb3cff7ea5cc9e3b34f45d1821a1717-7" X-Cache: RefreshHit from cloudfront Via: 1.1 217d459a3c67cafb927fcead306b897e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-C1 X-Amz-Cf-Id: l2j8YHP3iiwtQEU2dL16aFijXoHziQV2ULaYeKr3rqvTjYspvTA9rQ==
2024-12-12 10:16:46 UTC	15872	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 02 1f c5 7b 46 7e ab 28 46 7e ab 28 46 7e ab 28 4f 06 38 28 55 7e ab 28 46 7e aa 28 1e 7c ab 28 4f 06 3e 28 5c 7e ab 28 4f 06 28 28 f7 7e ab 28 4f 06 2f 28 ce 7e ab 28 4f 06 21 28 41 7e ab 28 4f 06 3f 28 47 7e ab 28 4f 06 3a 28 47 7e ab 28 52 69 63 68 46 7e ab 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 be 05 47 67 00 00 00 00 00 00 00 00 e0 00 03 Data Ascii: MZ@!L!This program cannot be run in DOS mode.${F~(F~(F~(O8(U~(F~(\|(O>(\~(O((~(O/(~(O!(A~(O?(G~(O:(G~(RichF~(PELGg
2024-12-12 10:16:46 UTC	16384	IN	Data Raw: 57 00 07 80 e8 f7 e1 ff ff 8b 45 c0 8b e5 5d c2 1c 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 1c 89 4d e4 8b 45 08 0f b7 08 81 f9 6c 07 00 00 7d 2e c7 45 f8 00 00 00 00 c7 45 fc 00 00 00 00 8b 55 fc 52 8b 45 f8 50 8d 4d f0 e8 eb fd ff ff 8b 4d e4 8b 55 f0 89 11 8b 45 f4 89 41 04 eb 49 8b 4d 0c 51 8b 55 08 0f b7 42 0c 50 8b 4d 08 0f b7 51 0a 52 8b 45 08 0f b7 48 08 51 8b 55 08 0f b7 42 06 50 8b 4d 08 0f b7 51 02 52 8b 45 08 0f b7 08 51 8d 4d e8 e8 c0 fd ff ff 8b 55 e4 8b 45 e8 89 02 8b 4d ec 89 4a 04 8b 45 e4 8b e5 5d c2 08 00 cc cc cc cc cc cc cc cc cc 55 8b ec 51 89 4d fc 8b 45 fc 8b 08 2b 4d 0c 8b 50 04 1b 55 10 52 51 8b 4d 08 e8 61 fd ff ff 8b 45 08 8b e5 5d c2 0c 00 cc cc cc cc cc cc cc cc 55 8b ec a1 b0 0c 44 00 5d c3 cc cc cc cc cc Data Ascii: WE]UMEl}.EEUREPMMUEAIMQUBPMQREHQUBPMQREQMUEMJE]UQME+MPURQMaE]UD]
2024-12-12 10:16:46 UTC	16384	IN	Data Raw: 85 c0 75 0e 57 ff 15 04 e4 42 00 57 ff 15 08 e4 42 00 33 c0 40 5f 5e c3 8b ff 55 8b ec 56 e8 eb 18 00 00 80 78 14 00 8b 75 08 75 23 85 f6 7d 08 81 fe 01 80 00 00 75 17 e8 04 19 00 00 8b 48 04 85 c9 74 0b ff 75 10 8b 01 56 ff 50 70 eb 28 68 9b 5e 40 00 b9 70 e2 43 00 e8 f7 1e 00 00 85 c0 75 05 e8 18 d4 ff ff ff 75 10 ff 75 0c 56 ff 70 2c ff 15 fc e3 42 00 5e 5d c2 0c 00 8b ff 55 8b ec 83 ec 20 53 8b 5d 0c 56 33 f6 89 4d fc 3b de 75 07 33 c0 e9 0c 01 00 00 8b 45 08 2b c6 57 74 72 48 48 74 0a 2d ff 7f 00 00 e9 f3 00 00 00 ff 33 e8 c9 5c 00 00 3b c6 74 59 8b c8 e8 41 6b 00 00 8b f8 3b fe 74 4c 8b cf e8 3f 47 00 00 85 c0 74 41 39 77 68 74 3c e8 80 e6 ff ff 8b f8 8b 45 fc 39 70 20 74 2d 53 e8 06 fd ff ff 59 85 c0 75 09 81 7b 04 02 02 00 00 75 19 56 68 46 e1 00 Data Ascii: uWBWB3@_^UVxuu#}uHtuVPp(h^@pCuuuVp,B^]U S]V3M;u3E+WtrHHt-3\;tYAk;tL?GtA9wht<E9p t-SYu{uVhF
2024-12-12 10:16:46 UTC	15998	IN	Data Raw: 00 ff 75 20 8b 75 bc 8b 03 83 ec 10 8b fc a5 a5 a5 53 a5 ff 50 34 e9 23 01 00 00 83 7f 08 01 0f 85 23 01 00 00 8b 4d 20 8b 75 bc 8b 03 83 c1 08 51 83 ec 10 8b fc a5 a5 a5 53 a5 ff 50 30 e9 7e fe ff ff 84 ca 74 28 83 7f 08 01 0f 85 f7 00 00 00 8b 4d 20 8b 75 bc 8b 03 83 c1 08 51 83 ec 10 8b fc a5 a5 a5 53 a5 ff 50 2c e9 52 fe ff ff f6 c1 04 74 4c 39 57 08 0f 85 cb 00 00 00 8b 75 bc 8b 45 c0 66 83 38 08 8d 7d d0 a5 a5 a5 a5 74 18 6a 03 6a 00 50 8d 45 f0 50 ff 15 10 e3 42 00 8b f0 85 f6 7c 75 8d 45 f0 8b 40 08 8b 0b 50 83 ec 10 8b fc 8d 75 d0 a5 a5 a5 53 a5 ff 51 6c eb 7e 84 ca 74 24 83 7f 08 01 75 7e 8b 4d 20 8b 75 bc 8b 03 83 c1 08 51 83 ec 10 8b fc a5 a5 a5 53 a5 ff 50 28 e9 d9 fd ff ff f6 c1 04 74 55 39 57 08 75 56 8b 75 bc 8b 45 c0 66 83 38 08 8d 7d d0 Data Ascii: u uSP4##M uQSP0~t(M uQSP,RtL9WuEf8}tjjPEPB\|uE@PuSQl~t$u~M uQSP(tU9WuVuEf8}
2024-12-12 10:16:46 UTC	16384	IN	Data Raw: 4d 0c 0f bf d1 c1 e9 10 0f bf c9 89 55 08 89 4d 0c 83 f8 2a 75 12 56 e8 e5 de ff ff 50 ff 75 0c ff 75 08 e9 3a ff ff ff 51 52 e9 0e 01 00 00 56 e9 f1 fe ff ff 56 ff 75 0c 8b cf ff d3 e9 b9 fb ff ff 8b 45 0c 56 c1 e8 10 eb ad 0f bf c6 c1 ee 10 0f bf ce 51 e9 04 ff ff ff 0f bf c6 c1 ee 10 0f bf ce 51 50 8b 45 0c c1 e8 10 50 0f b7 45 0c 50 8b cf ff d3 89 45 f0 e9 ac fb ff ff 0f bf c6 c1 ee 10 0f bf ce 51 50 8b 45 0c c1 e8 10 50 0f b7 45 0c 50 8b cf ff d3 e9 c2 00 00 00 8b cf ff d3 89 45 f0 85 c0 0f 84 b3 00 00 00 e9 1c fd ff ff 56 e8 90 16 00 00 e9 5d fd ff ff 56 e8 85 16 00 00 50 e9 8d 00 00 00 56 ff 75 0c e8 76 16 00 00 e9 6d fe ff ff 0f b7 ce 51 8b c6 c1 e8 10 8b c8 81 e1 00 f0 00 00 51 25 ff 0f 00 00 50 ff 75 0c e8 0b de ff ff 50 8b cf ff d3 e9 fb fa ff Data Ascii: MUM*uVPuu:QRVVuEVQQPEPEPEQPEPEPEV]VPVuvmQQ%PuP
2024-12-12 10:16:46 UTC	16384	IN	Data Raw: 5d c3 8b ff 55 8b ec 83 ec 10 ff 75 0c 8d 4d f0 e8 18 f1 ff ff 0f b6 45 08 8b 4d f0 8b 89 c8 00 00 00 0f b7 04 41 25 00 80 00 00 80 7d fc 00 74 07 8b 4d f8 83 61 70 fd c9 c3 8b ff 55 8b ec 6a 00 ff 75 08 e8 b9 ff ff ff 59 59 5d c3 8b ff 55 8b ec 68 07 01 00 00 ff 75 08 e8 99 9c 00 00 59 59 5d c3 8b ff 55 8b ec 8b 45 08 0f b7 08 53 56 57 66 85 c9 74 2c 8b 5d 0c 0f b7 3b 0f b7 c9 8b f3 66 3b f9 74 12 0f b7 d7 66 85 d2 74 14 46 46 0f b7 16 66 3b d1 75 f1 40 40 0f b7 08 66 85 c9 75 dd 2b 45 08 5f 5e d1 f8 5b 5d c3 8b ff 55 8b ec 8b 45 08 66 83 38 00 53 56 57 74 2a 8b 5d 0c 0f b7 3b 8b d3 66 85 ff 74 15 0f b7 30 0f b7 cf 66 3b ce 74 12 42 42 0f b7 0a 66 85 c9 75 f1 40 40 66 83 38 00 75 dc 2b 45 08 5f 5e d1 f8 5b 5d c3 8b ff 55 8b ec 8b 45 08 8b d0 66 8b 08 40 Data Ascii: ]UuMEMA%}tMapUjuYY]UhuYY]UESVWft,];f;tftFFf;u@@fu+E_^[]UEf8SVWt*];ft0f;tBBfu@@f8u+E_^[]UEf@
2024-12-12 10:16:46 UTC	16384	IN	Data Raw: 35 98 e1 42 00 ff d6 85 c0 74 21 a1 48 cf 43 00 83 f8 ff 74 17 50 ff 35 4c cf 43 00 ff d6 ff d0 85 c0 74 08 8b 80 f8 01 00 00 eb 27 be 60 0c 43 00 56 ff 15 7c e2 42 00 85 c0 75 0b 56 e8 49 bc ff ff 59 85 c0 74 18 68 50 0c 43 00 50 ff 15 e4 e2 42 00 85 c0 74 08 ff 75 08 ff d0 89 45 08 8b 45 08 5e 5d c3 6a 00 e8 87 ff ff ff 59 c3 8b ff 55 8b ec 56 ff 35 4c cf 43 00 8b 35 98 e1 42 00 ff d6 85 c0 74 21 a1 48 cf 43 00 83 f8 ff 74 17 50 ff 35 4c cf 43 00 ff d6 ff d0 85 c0 74 08 8b 80 fc 01 00 00 eb 27 be 60 0c 43 00 56 ff 15 7c e2 42 00 85 c0 75 0b 56 e8 ce bb ff ff 59 85 c0 74 18 68 7c 0c 43 00 50 ff 15 e4 e2 42 00 85 c0 74 08 ff 75 08 ff d0 89 45 08 8b 45 08 5e 5d c3 ff 15 84 e1 42 00 c2 04 00 8b ff 56 ff 35 4c cf 43 00 ff 15 98 e1 42 00 8b f0 85 f6 75 1b ff Data Ascii: 5Bt!HCtP5LCt'`CV\|BuVIYthPCPBtuEE^]jYUV5LC5Bt!HCtP5LCt'`CV\|BuVYth\|CPBtuEE^]BV5LCBu
2024-12-12 10:16:46 UTC	14808	IN	Data Raw: ff ff 83 c4 0c 3b c3 0f 84 04 01 00 00 53 53 53 53 53 e8 f1 82 ff ff 83 c4 14 e9 f2 00 00 00 a1 a0 0b 44 00 3b c3 74 0d 50 e8 e2 6f ff ff 59 89 1d a0 0b 44 00 68 f0 0a 44 00 ff 15 10 e1 42 00 3b c7 0f 84 c2 00 00 00 33 c9 41 89 0d 9c 0b 44 00 a1 f0 0a 44 00 6b c0 3c 89 45 e4 66 39 1d 36 0b 44 00 74 0e 8b 15 44 0b 44 00 6b d2 3c 03 c2 89 45 e4 66 39 1d 8a 0b 44 00 74 1a a1 98 0b 44 00 3b c3 74 11 89 4d dc 2b 05 44 0b 44 00 6b c0 3c 89 45 d8 eb 06 89 5d dc 89 5d d8 8d 45 d0 50 53 6a 3f 8b 45 e0 ff 30 57 68 f4 0a 44 00 53 ff 75 cc 8b 3d cc e2 42 00 ff d7 85 c0 74 0f 39 5d d0 75 0a 8b 45 e0 8b 00 88 58 3f eb 07 8b 45 e0 8b 00 88 18 8d 45 d0 50 53 6a 3f 8b 45 e0 ff 70 04 6a ff 68 48 0b 44 00 53 ff 75 cc ff d7 85 c0 74 10 39 5d d0 75 0b 8b 45 e0 8b 40 04 88 58 Data Ascii: ;SSSSSD;tPoYDhDB;3ADDk<Ef96DtDDk<Ef9DtD;tM+DDk<E]]EPSj?E0WhDSu=Bt9]uEX?EEPSj?EpjhHDSut9]uE@X
2024-12-12 10:16:46 UTC	1576	IN	Data Raw: 6a 08 68 e8 91 43 00 e8 b6 5e ff ff 8b 45 10 f7 00 00 00 00 80 74 05 8b 5d 0c eb 0a 8b 48 08 8b 55 0c 8d 5c 11 0c 83 65 fc 00 8b 75 14 56 50 ff 75 0c 8b 7d 08 57 e8 46 fe ff ff 83 c4 10 48 74 1f 48 75 34 6a 01 8d 46 08 50 ff 77 18 e8 a6 fb ff ff 59 59 50 ff 76 18 53 e8 b4 56 ff ff eb 18 8d 46 08 50 ff 77 18 e8 8c fb ff ff 59 59 50 ff 76 18 53 e8 9a 56 ff ff c7 45 fc fe ff ff ff e8 83 5e ff ff c3 33 c0 40 c3 8b 65 e8 e8 55 dd ff ff cc 8b ff 55 8b ec 83 7d 18 00 74 10 ff 75 18 53 56 ff 75 08 e8 56 ff ff ff 83 c4 10 83 7d 20 00 ff 75 08 75 03 56 eb 03 ff 75 20 e8 58 56 ff ff ff 37 ff 75 14 ff 75 10 56 e8 ae f9 ff ff 8b 47 04 68 00 01 00 00 ff 75 1c 40 ff 75 14 89 46 08 ff 75 0c 8b 4b 0c 56 ff 75 08 e8 f5 fb ff ff 83 c4 28 85 c0 74 07 56 50 e8 e2 55 ff ff 5d Data Ascii: jhC^Et]HU\euVPu}WFHtHu4jFPwYYPvSVFPwYYPvSVE^3@eUU}tuSVuV} uuVu XV7uuVGhu@uFuKVu(tVPU]
2024-12-12 10:16:46 UTC	16384	IN	Data Raw: 75 10 ff 75 0c 51 e8 c1 fb ff ff 83 c4 20 33 c0 40 5f 5e 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 04 53 51 8b 45 0c 83 c0 0c 89 45 fc 8b 45 08 55 ff 75 10 8b 4d 10 8b 6d fc e8 61 34 00 00 56 57 ff d0 5f 5e 8b dd 5d 8b 4d 10 55 8b eb 81 f9 00 01 00 00 75 05 b9 02 00 00 00 51 e8 3f 34 00 00 5d 59 5b c9 c2 0c 00 cc cc cc cc 56 8b 44 24 14 0b c0 75 28 8b 4c 24 10 8b 44 24 0c 33 d2 f7 f1 8b d8 8b 44 24 08 f7 f1 8b f0 8b c3 f7 64 24 10 8b c8 8b c6 f7 64 24 10 03 d1 eb 47 8b c8 8b 5c 24 10 8b 54 24 0c 8b 44 24 08 d1 e9 d1 db d1 ea d1 d8 0b c9 75 f4 f7 f3 8b f0 f7 64 24 14 8b c8 8b 44 24 10 f7 e6 03 d1 72 0e 3b 54 24 0c 77 08 72 0f 3b 44 24 08 76 09 4e 2b 44 24 10 1b 54 24 14 33 db 2b 44 24 08 1b 54 24 0c f7 da f7 d8 83 da 00 8b ca 8b d3 8b d9 Data Ascii: uuQ 3@_^[]USQEEEUuMma4VW_^]MUuQ?4]Y[VD$u(L$D$3D$d$d$G\$T$D$ud$D$r;T$wr;D$vN+D$T$3+D$T$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49894	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:45 UTC	354	OUT	GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=31bb936f-6d29-4437-958a-41894ec1c07b&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:16:45 UTC	322	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:45 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 74 Connection: close Access-Control-Allow-Methods: OPTIONS, GET, POST Age: 0 Cache-Control: no-cache Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:45 UTC	74	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 20 32 30 30 2c 20 22 6d 65 73 73 61 67 65 22 3a 20 22 4f 4b 22 2c 20 22 61 63 74 69 6f 6e 22 3a 20 22 6c 65 61 76 65 22 2c 20 22 73 65 72 76 69 63 65 22 3a 20 22 50 72 65 73 65 6e 63 65 22 7d Data Ascii: {"status": 200, "message": "OK", "action": "leave", "service": "Presence"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49895	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:45 UTC	159	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=a59345e3-8f8c-485b-a783-ef9be618e04a&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com
2024-12-12 10:16:45 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:45 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:45 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 36 30 35 33 35 31 37 32 36 34 5d Data Ascii: [17339986053517264]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49908	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:48 UTC	354	OUT	GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=bd60ea28-235d-43b9-aee1-8ff123cbf3ec&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:16:49 UTC	322	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:48 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 74 Connection: close Access-Control-Allow-Methods: OPTIONS, GET, POST Age: 0 Cache-Control: no-cache Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:49 UTC	74	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 20 32 30 30 2c 20 22 6d 65 73 73 61 67 65 22 3a 20 22 4f 4b 22 2c 20 22 61 63 74 69 6f 6e 22 3a 20 22 6c 65 61 76 65 22 2c 20 22 73 65 72 76 69 63 65 22 3a 20 22 50 72 65 73 65 6e 63 65 22 7d Data Ascii: {"status": 200, "message": "OK", "action": "leave", "service": "Presence"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49913	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:48 UTC	358	OUT	GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=e3c12418-7b83-4291-816c-71960a33cc91&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:16:49 UTC	322	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:48 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 55 Connection: close Access-Control-Allow-Methods: OPTIONS, GET, POST Age: 0 Cache-Control: no-cache Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:49 UTC	55	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 20 32 30 30 2c 20 22 6d 65 73 73 61 67 65 22 3a 20 22 4f 4b 22 2c 20 22 73 65 72 76 69 63 65 22 3a 20 22 50 72 65 73 65 6e 63 65 22 7d Data Ascii: {"status": 200, "message": "OK", "service": "Presence"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49931	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:51 UTC	159	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=251ddf58-e932-4891-bf1a-41fcf25995e8&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com
2024-12-12 10:16:51 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:51 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:51 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 36 31 31 36 37 34 34 36 32 38 5d Data Ascii: [17339986116744628]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49932	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:51 UTC	340	OUT	GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=b54b0744-77ba-461d-8569-6e8a97c304cf&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:16:52 UTC	277	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:52 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 45 Connection: close Cache-Control: no-cache Access-Control-Allow-Methods: GET Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:52 UTC	45	IN	Data Raw: 7b 22 74 22 3a 7b 22 74 22 3a 22 31 37 33 33 39 39 38 35 39 34 38 34 38 33 35 33 35 22 2c 22 72 22 3a 33 31 7d 2c 22 6d 22 3a 5b 5d 7d Data Ascii: {"t":{"t":"17339985948483535","r":31},"m":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49943	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:54 UTC	358	OUT	GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=97752f74-4e58-4d15-9e8f-db1d6f8f144c&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:16:54 UTC	322	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:54 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 55 Connection: close Access-Control-Allow-Methods: OPTIONS, GET, POST Age: 0 Cache-Control: no-cache Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:54 UTC	55	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 20 32 30 30 2c 20 22 6d 65 73 73 61 67 65 22 3a 20 22 4f 4b 22 2c 20 22 73 65 72 76 69 63 65 22 3a 20 22 50 72 65 73 65 6e 63 65 22 7d Data Ascii: {"status": 200, "message": "OK", "service": "Presence"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49944	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:54 UTC	354	OUT	GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/leave?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=a1dfed27-241b-4f14-ac5c-7f603dad8ea7&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:16:55 UTC	322	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:54 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 74 Connection: close Access-Control-Allow-Methods: OPTIONS, GET, POST Age: 0 Cache-Control: no-cache Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:55 UTC	74	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 20 32 30 30 2c 20 22 6d 65 73 73 61 67 65 22 3a 20 22 4f 4b 22 2c 20 22 61 63 74 69 6f 6e 22 3a 20 22 6c 65 61 76 65 22 2c 20 22 73 65 72 76 69 63 65 22 3a 20 22 50 72 65 73 65 6e 63 65 22 7d Data Ascii: {"status": 200, "message": "OK", "action": "leave", "service": "Presence"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49958	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:57 UTC	340	OUT	GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=84cc88c2-8b2d-4972-98ab-93ca822d3bc9&tt=0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49963	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:16:57 UTC	159	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=e5a579a7-c4bc-463e-9f73-b45c1d474e19&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com
2024-12-12 10:16:58 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:16:58 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:16:58 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 36 31 38 30 31 39 34 34 31 34 5d Data Ascii: [17339986180194414]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49974	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:17:00 UTC	358	OUT	GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=93bec789-cd0a-4d0a-a674-9b9877a6ea0c&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:17:01 UTC	322	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:17:00 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 55 Connection: close Access-Control-Allow-Methods: OPTIONS, GET, POST Age: 0 Cache-Control: no-cache Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:17:01 UTC	55	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 20 32 30 30 2c 20 22 6d 65 73 73 61 67 65 22 3a 20 22 4f 4b 22 2c 20 22 73 65 72 76 69 63 65 22 3a 20 22 50 72 65 73 65 6e 63 65 22 7d Data Ascii: {"status": 200, "message": "OK", "service": "Presence"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49975	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:17:00 UTC	358	OUT	GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=2c1aba4a-e431-4a67-92c5-413fd16fcfc0&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:17:01 UTC	323	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:17:01 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 55 Connection: close Access-Control-Allow-Methods: OPTIONS, GET, POST Age: 12 Cache-Control: no-cache Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:17:01 UTC	55	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 20 32 30 30 2c 20 22 6d 65 73 73 61 67 65 22 3a 20 22 4f 4b 22 2c 20 22 73 65 72 76 69 63 65 22 3a 20 22 50 72 65 73 65 6e 63 65 22 7d Data Ascii: {"status": 200, "message": "OK", "service": "Presence"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49987	13.232.67.198	443	8100	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:17:03 UTC	159	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=09b4d2d8-8846-4ef1-b6ed-8d14f0917a88&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com
2024-12-12 10:17:04 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:17:03 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:17:04 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 36 32 33 37 36 30 33 37 31 38 5d Data Ascii: [17339986237603718]

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	50025	52.222.144.9	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:17:16 UTC	204	OUT	GET /agentpackagesnet45/AgentPackageUpgradeAgent/27.6/AgentPackageUpgradeAgent.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1 Host: ps.atera.com Connection: Keep-Alive
2024-12-12 10:17:16 UTC	671	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 584433 Connection: close Content-MD5: tQg0aUODlggwz0jZg24RCA== Last-Modified: Thu, 07 Nov 2024 08:55:12 GMT Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: eda35f03-001e-0020-3686-4b066d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Thu, 12 Dec 2024 04:40:31 GMT ETag: 0x8DCFF09E4169B5F Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c71d96b07b5616a6017c1713d231dd8e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MRS52-C2 X-Amz-Cf-Id: 7R07npfXzNINavobjFcNgT7aFBRucUXKudcNks5m8sLGZQG0uaxQbw== Age: 20302
2024-12-12 10:17:16 UTC	15713	IN	Data Raw: 50 4b 03 04 2d 00 09 08 08 00 e3 46 67 59 8b cc 91 c7 ff ff ff ff ff ff ff ff 35 00 14 00 41 67 65 6e 74 50 61 63 6b 61 67 65 55 70 67 72 61 64 65 41 67 65 6e 74 2f 41 67 65 6e 74 50 61 63 6b 61 67 65 55 70 67 72 61 64 65 41 67 65 6e 74 2e 65 78 65 01 00 10 00 28 e2 00 00 00 00 00 00 63 68 00 00 00 00 00 00 37 35 64 b1 dd 1c fe 96 80 7f ac 19 b4 7a b4 f2 4c 04 d8 18 e8 d2 35 b9 cb 96 b6 2a a4 90 d1 53 a6 27 95 3f c8 1f f2 87 68 89 36 dd f4 45 6f 02 11 b3 c1 0d 22 79 09 e9 c5 16 1c f6 35 f9 b4 f1 7a 5f c2 90 83 c0 79 88 07 26 95 db 10 d6 4c 0e cb 5a 5a 36 fb bc a6 a3 80 3d 55 ca a7 a9 d3 66 ac e4 a6 d8 4a 59 6a b2 b9 14 cd 16 18 a1 c8 2f d0 8e be 7e dc 25 ff c7 08 bb 80 8a 31 2c 3d 04 f2 e8 a8 8f d9 2c da 4a d5 1f f3 8c bd 0d 65 47 8d 3d a0 69 d8 a2 ef 47 Data Ascii: PK-FgY5AgentPackageUpgradeAgent/AgentPackageUpgradeAgent.exe(ch75dzL5*S'?h6Eo"y5z_y&LZZ6=UfJYj/~%1,=,JeG=iG
2024-12-12 10:17:16 UTC	16384	IN	Data Raw: b6 33 99 5b 9d c6 d4 ee eb 82 57 b9 fd 64 1b 39 dd a8 d7 59 6b df 84 75 d6 e5 f9 51 91 e6 4e 3d 76 ec 28 52 30 80 fe 56 70 02 a7 17 4f 95 65 00 9a 36 24 c1 95 f5 b6 93 6e 1f c2 68 e4 a0 92 fb 04 6f a0 28 2f 9a 07 b0 f1 c6 a4 9d 4e 04 23 b0 0a 60 06 64 40 b1 58 c7 ef 5e 8d 4d ed ee 69 38 a6 85 a4 fa 6e b4 54 dd 75 d4 53 21 44 08 d2 70 f8 73 e5 87 c7 ee 32 25 91 79 87 94 5b 33 a7 03 79 c1 bf 7b 1b b1 a0 c0 cd e8 e7 70 d5 4e 4f ac d7 2a 58 89 1a c7 15 8e 35 d3 57 b4 db a3 9a 1e 79 52 8f a3 28 ca 96 f4 17 e5 78 8a b5 f3 69 59 cc 71 a1 52 ef 3c a7 95 c3 27 33 7d 45 58 d2 ed 09 a8 1a 80 df bb 3a 21 83 a5 19 20 28 24 f3 e6 34 42 cd 4c 43 cc 17 7c f0 32 af 2c 4a 5e dc 0a 0e 02 68 87 db 8f 18 e2 35 97 aa b1 5e 0c 32 d5 83 2b 80 35 28 96 35 7e 0d 65 fa 10 fe 41 cd Data Ascii: 3[Wd9YkuQN=v(R0VpOe6$nho(/N#`d@X^Mi8nTuS!Dps2%y[3y{pNO*X5WyR(xiYqR<'3}EX:! ($4BLC\|2,J^h5^2+5(5~eA
2024-12-12 10:17:16 UTC	16384	IN	Data Raw: b3 a9 36 8f e0 9a b6 24 2d 79 3a 3c 6b 00 16 eb 3f e4 ff 79 58 e2 c7 88 f8 56 8c 5a 3d 9c 22 68 2a 2e 84 6e 81 3c 27 23 ff 46 52 8b 5a 1a da 06 01 81 a4 20 fe c0 b8 83 87 60 54 a8 1a b0 7e 94 f4 75 fb c4 af 9c df ad 1d 08 c9 b8 9c 3e 83 4c 2c b8 27 17 8d 0e 18 62 44 1b af c6 a9 78 ec 5b 89 7c a0 2c 2f cc 75 8d ae 26 b1 e3 ca 10 f8 9e 08 e0 ff b4 3f 5b cd a7 f2 24 1a f9 86 9b 75 d6 73 c3 0a da 16 6f 64 dc 93 d3 da 07 fe 52 25 8c 14 18 09 61 bf 91 5d 33 93 62 63 b4 33 05 c4 7d 13 52 41 c3 27 e4 f8 5b ca e1 b6 bc 92 db e2 f4 7c 2c d2 84 b9 64 39 f8 b9 bf 4f 31 82 fe 78 51 26 e2 1b fe 45 87 e4 ad 3f 83 55 d6 ff f0 f3 58 d9 59 ce 89 0c 51 03 56 be 5d 5b 14 3a 6f 19 c8 52 97 98 82 2d 5d d3 2c e0 6d d4 75 bb 54 21 a5 1b 45 ee 48 32 ca 71 e5 c5 5b e6 d1 6a 2c 84 Data Ascii: 6$-y:<k?yXVZ="h*.n<'#FRZ `T~u>L,'bDx[\|,/u&?[$usodR%a]3bc3}RA'[\|,d9O1xQ&E?UXYQV][:oR-],muT!EH2q[j,
2024-12-12 10:17:16 UTC	16384	IN	Data Raw: 8f 14 b2 53 bd ed 36 88 54 c0 e4 e7 86 98 5d 16 1b 6d 03 50 54 0b b0 1f 26 a6 c7 7e 3a 59 87 af 85 b9 ed 0e cb 5a 15 67 dd 9d 7a 5e 37 91 c1 c9 ae a1 20 af c3 01 ae 02 e5 7d c2 63 2f 6e 38 e5 36 15 58 dd ce cf ea 66 23 f2 cb b2 58 81 6f 0c b7 53 ee 77 44 e2 91 90 be 61 a9 ac 19 2e 79 9a ed f9 bb f3 40 57 4a 84 d9 18 2d b4 d2 9d 22 49 bd 9e 4c c2 af 3f 08 65 e1 68 d2 27 4b 70 0c 41 66 08 43 05 2c a6 f6 e0 5f 6a b4 a2 2e 9f 7a 1b 8e 47 81 19 c1 a3 51 25 c4 ca bb 4f 5c d8 58 c2 85 c2 3e b9 9a 05 d1 bd 26 81 ff 6c ee d6 4f c5 64 71 84 a2 d3 2f 5d 4d b7 05 4c 76 4b a7 21 a5 56 80 5c c2 28 8a 2a 8a 67 07 c2 df fc 47 d1 1d 97 59 fd 6e 13 a8 5f 86 2f 43 d6 67 c4 64 19 0e 9e 58 8f 97 59 d4 7e 63 62 38 70 9b 8d 24 0a 18 24 fa ad a8 61 e3 c8 87 80 d6 73 0b 09 03 bf Data Ascii: S6T]mPT&~:YZgz^7 }c/n86Xf#XoSwDa.y@WJ-"IL?eh'KpAfC,_j.zGQ%O\X>&lOdq/]MLvK!V\(*gGYn_/CgdXY~cb8p$$as
2024-12-12 10:17:16 UTC	16384	IN	Data Raw: 77 ee 99 6f 57 80 cd 32 2c 7a 2e 96 0e 09 7b cc be 28 ba 19 2e 03 4c 8d ba 42 93 94 3b 73 d5 4c 62 d5 09 04 37 24 d3 89 0c ad 77 fe 16 83 d9 dc 76 21 56 21 4b df bb e8 d9 37 30 9a e5 0f 56 fb 58 02 40 3c 2d 78 c0 25 ea 51 05 a8 3c 1c 6f 87 21 c2 e7 a1 9d 5b b3 10 c0 4c d8 9e 1a 5e de 92 b7 59 34 03 63 57 35 fb 43 1d 48 80 2e be 04 61 a7 28 e7 6f 51 7f 29 c5 79 3e 3c a3 ed f1 ae 58 7c 4b 5b c2 e1 d2 d8 b0 11 2b 37 b6 38 f6 8b a9 cf 76 f7 a9 2b 3e ec 44 3f 96 60 c4 51 2c d9 f9 7a c4 ed cd 9c 3b 2b 9e d3 81 00 64 14 c9 e9 91 e8 7d 5f 0c 85 70 1b fc a3 83 b6 40 a4 74 e7 8d de 94 1a f4 b3 8e eb 28 4f 6c 67 27 c0 db 5c eb cf 5e 6e ed 39 19 e8 8b 88 d7 02 07 06 21 bf bc 37 dd 2c 11 00 7a 02 d7 07 4a 71 64 f5 96 ed 49 90 0d a5 fd 98 59 ff 91 01 cd e7 44 ea 72 22 Data Ascii: woW2,z.{(.LB;sLb7$wv!V!K70VX@<-x%Q<o![L^Y4cW5CH.a(oQ)y><X\|K[+78v+>D?`Q,z;+d}_p@t(Olg'\^n9!7,zJqdIYDr"
2024-12-12 10:17:17 UTC	16384	IN	Data Raw: 49 89 06 b1 a8 c8 b7 b3 46 16 e0 e1 1c a2 19 0f 27 8c 82 fd 7a 2f c2 8c 9b c4 43 99 90 24 86 f6 27 cb 3c a4 09 b3 79 d1 a6 20 d1 97 13 8a 8e 08 0b bd 24 00 5c 69 f2 dc 63 7c 62 38 02 3b 74 56 70 9f 35 95 45 cd b6 8e 94 95 34 8a 5e 03 a2 1b ea f7 1e f9 12 c3 14 6e 83 e8 2f 5a 2d 89 8e da d2 91 e1 62 ad 41 1f 19 78 ee 81 2b 93 49 3b c8 54 d6 d7 e6 dc a1 68 82 6f 3b 94 c6 59 ea f7 96 b0 ad 51 61 30 72 ea 0d 73 bb 86 1f d8 4c c9 44 5e 14 1e 36 2c 8b e6 eb e0 f5 f8 4d 0b 76 5c 7c 9e 95 d7 84 8c 5c b2 82 35 5c 94 a6 ef 71 a5 ae c3 c7 aa da f6 35 d0 db 99 ac a7 90 ab 60 74 fc ba ec c0 36 0c 7b 09 54 df 5b 5e 20 13 7f a9 d8 60 3a 97 db d7 c8 84 34 11 5a af 64 d4 14 e5 41 19 83 3b 60 ce 23 7b 68 7b 9a 3b 83 da 00 ba bd 07 16 72 c6 86 af ac a5 28 29 eb 82 bb 8a 7c Data Ascii: IF'z/C$'<y $\ic\|b8;tVp5E4^n/Z-bAx+I;Tho;YQa0rsLD^6,Mv\\|\5\q5`t6{T[^ `:4ZdA;`#{h{;r()\|
2024-12-12 10:17:17 UTC	16384	IN	Data Raw: 9e 86 38 5b 0f 9e e3 79 7a 4b 2d 6a f0 59 e9 79 bd ee 56 97 e9 21 e0 7b 79 ec da 47 b2 70 8d 92 45 2a f9 ba 58 d9 10 73 2b 52 a4 b7 69 9c 3d 13 fa a3 31 3c 1e d9 6b 76 a4 a6 c5 59 88 ad 37 cb e1 13 fb 91 42 8a 7d 6c 6b c9 ea c5 82 08 d0 7e ba e9 0a a1 16 38 cf e9 81 f3 d5 b1 b8 99 4c aa d9 6c 1f c7 d1 f5 38 c6 7b 1f 0a d6 1c f9 9c e4 74 0b a3 46 88 50 f9 37 ad cd cc 32 7f 05 53 12 ca d1 ce a8 e1 42 22 3c b0 1f c4 fe 96 0c 03 a5 83 6f 09 2e 46 50 9c c8 7e 1c e0 68 23 80 ee 41 82 94 72 04 3b ef 44 cc 9a dd 26 9b ab 29 af bd 6b 13 d2 d8 71 f5 04 e5 65 c2 1e e9 2c 7a 6f 77 a9 ef d2 ac 4a 1b 47 b8 cb 25 e9 57 b5 d2 02 c1 d1 db 15 d2 27 ea 0f 86 9f e7 1b 34 e9 5d 55 66 dd 48 cb de 22 8a ce b3 37 32 06 1c e8 dc f8 09 f8 22 ed 37 72 fc c9 39 c7 95 2f 6b 62 54 8b Data Ascii: 8[yzK-jYyV!{yGpE*Xs+Ri=1<kvY7B}lk~8Ll8{tFP72SB"<o.FP~h#Ar;D&)kqe,zowJG%W'4]UfH"72"7r9/kbT
2024-12-12 10:17:17 UTC	16384	IN	Data Raw: d5 9c 09 80 e3 0a 81 e4 40 3b 09 72 51 50 02 c1 df 97 a5 41 63 4a ed 79 8e f1 18 9c 55 14 08 4b e2 33 97 73 1a c7 5d 6c 92 88 89 bc a1 ab 1c fe 24 87 19 0d ac ca 50 a9 88 02 69 23 f5 38 67 55 c6 af a2 9d 65 08 02 56 11 df 87 4c e1 fc a9 2b b0 e1 de c4 70 15 51 2e be 08 ec 66 0a 70 c4 06 aa 2e 1d 99 c9 a4 33 be c2 e2 75 ed 02 21 e3 cf 98 bc 28 c9 8f 8b 8a 6d f8 0f b1 1f 67 29 59 d9 4a c7 ff d9 ec 60 40 2c 4b 89 55 ea c9 52 e3 f1 f6 cf d3 53 cf 22 ec 30 f5 ba 54 bd c5 ad d4 a4 c0 49 52 b1 c5 ed 7a 89 2a 13 8b a1 79 c1 2e e5 1d 6e 37 03 6e 9f 26 46 cf 2a 75 68 f0 bd 85 9e 40 ae 44 db a8 8b e4 98 8e 72 c1 a9 2e 5a 1b f0 0c 9d d8 38 df e8 18 cd 31 56 7b c7 b1 d6 ff 70 b5 da 09 3e 2a 13 61 36 4c a2 60 09 55 4c d0 78 ec 71 fd f0 58 e1 d5 4c 02 f7 7f 2c 20 a3 23 Data Ascii: @;rQPAcJyUK3s]l$Pi#8gUeVL+pQ.fp.3u!(mg)YJ`@,KURS"0TIRzy.n7n&Fuh@Dr.Z81V{p>*a6L`ULxqXL, #
2024-12-12 10:17:17 UTC	16384	IN	Data Raw: 1a 57 fd 2f 11 74 e6 98 1b 44 52 3c 78 01 b4 b5 59 cb ca 2c 32 19 d4 56 0d 88 e9 a8 9b 02 5f fc d7 1f b8 3f ff aa 38 4c a7 a7 2c f9 23 26 69 1e f8 5f 30 3a 22 56 3f 97 67 6c cc bd ee cf b7 69 1a 29 e2 b6 b4 81 6b 31 22 6b 7c 25 99 cf 49 71 16 d5 e9 84 39 0c d1 3f 63 c1 f9 98 d4 bc 4c f3 2d 1a a2 6e 2a ab c5 bc 67 a0 4b ec e5 03 37 b2 8a 40 84 1f e1 db e4 e9 5a c0 4d 6e bb 2c c6 68 fc cf 14 62 6f 1e 30 f2 13 5d a1 40 7a e3 d0 7c ac 39 89 e0 8e 12 b0 7a 11 cc 21 b1 13 d9 98 80 17 22 07 87 8e cd d8 09 da 5e c6 60 56 63 1d 03 e3 7b 95 1a 64 c4 25 b3 6b 9c d1 22 c2 0b 21 73 26 00 6a 3a 04 e7 7e 9c c8 e4 71 cf f1 05 de 59 f2 d1 a3 a7 21 c7 4f 1b b6 ec 61 15 90 c8 da d5 2d 9d 37 33 75 4d 77 ed db b0 8d 77 37 50 a1 d6 84 47 46 ba 89 86 e0 e8 25 ca 29 6b 1e d8 8f Data Ascii: W/tDR<xY,2V_?8L,#&i_0:"V?gli)k1"k\|%Iq9?cL-n*gK7@ZMn,hbo0]@z\|9z!"^`Vc{d%k"!s&j:~qY!Oa-73uMww7PGF%)k
2024-12-12 10:17:17 UTC	16384	IN	Data Raw: 67 d3 93 af 15 ec 97 cb 5c 17 05 cc 08 0c eb c1 52 63 a7 4b 5f e5 c9 cb 8b 38 ff 4e d9 d3 ae ad 00 97 0d ce 10 53 91 06 1b 1c e6 67 cb 13 35 4d 69 43 37 56 5d 3d 8a 93 53 04 40 03 37 af 85 8b 2b 38 da 4a 28 6c 48 64 79 9e 2f 71 fd d4 bf 5e 1f 99 1a 2d db a2 f4 e6 0c 8a 56 fb 12 2c c0 0d d3 1e 1b 63 a4 02 06 6b 40 b3 2d 35 af 6f d5 60 2c cc fb 97 d1 09 15 47 ee fd 45 b0 f8 60 ff 0b b8 8f dd 25 0b c4 d1 dc fb 1d be 5a 33 c5 90 30 64 2e 6c 33 92 ac f1 26 79 a2 6c 5a d9 9a 1c d1 ee b1 3c 8f a0 02 af 60 7e 7e 6f fb eb 5a 67 f5 3e 55 cb 41 d3 3c 64 25 8f 89 93 8e 20 fe d1 b9 78 02 0e 4d 2d b4 ee 56 92 fa 99 62 d5 82 b1 7d c5 76 12 9d 43 ee 04 88 14 2f fa 9e 13 30 88 12 16 7f 54 2c 89 4a d9 a5 b1 e1 85 68 28 28 cf a7 fe 5c ad 87 62 23 3f 39 f5 2f 9d f2 5c b7 bc Data Ascii: g\RcK_8NSg5MiC7V]=S@7+8J(lHdy/q^-V,ck@-5o`,GE`%Z30d.l3&ylZ<`~~oZg>UA<d% xM-Vb}vC/0T,Jh((\b#?9/\

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	50026	52.222.144.9	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:17:16 UTC	198	OUT	GET /agentpackagesnet45/AgentPackageTicketing/30.2/AgentPackageTicketing.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1 Host: ps.atera.com Connection: Keep-Alive
2024-12-12 10:17:16 UTC	671	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 3264797 Connection: close Content-MD5: /2cbYIW6NeG769XSOJq31g== Last-Modified: Tue, 26 Nov 2024 13:43:10 GMT Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 67221f77-401e-0053-16dc-4a5efe000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Thu, 12 Dec 2024 08:25:57 GMT ETag: 0x8DD0E204416D9D1 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 45bdeab129e36c3ee5b9b954d41fe070.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MRS52-C2 X-Amz-Cf-Id: MSCN45rSnbbcQNrCTPvQW2Q8FRdFywy3KpndtrFzbx1fRTROl7uwcg== Age: 6781
2024-12-12 10:17:16 UTC	15713	IN	Data Raw: 50 4b 03 04 2d 00 09 08 08 00 60 6d 7a 59 fc 57 85 97 ff ff ff ff ff ff ff ff 2f 00 14 00 41 67 65 6e 74 50 61 63 6b 61 67 65 54 69 63 6b 65 74 69 6e 67 2f 41 67 65 6e 74 50 61 63 6b 61 67 65 54 69 63 6b 65 74 69 6e 67 2e 65 78 65 01 00 10 00 28 82 00 00 00 00 00 00 90 48 00 00 00 00 00 00 e8 08 40 82 65 db 08 dd bd d4 52 e8 6c 8a e2 f7 9e 62 6b 53 e5 aa 62 f4 6f fd 26 c1 ed 13 f2 b7 fd 37 b2 6f d5 e9 cb fe d1 36 cc 35 7c bd e5 3e 18 e8 42 1a 38 d7 2b 43 38 c7 b2 fb 2a 63 d8 99 d4 09 9b 6a 30 d8 c9 d0 e9 1d 66 29 84 e9 0b e1 45 6c de 5f 1d c2 77 db 13 c2 db ec c2 a8 6c c7 a7 e5 e7 fa 1e 45 f2 92 52 f2 d5 c1 ff b1 de c5 4c 05 96 c9 04 2c 01 bd 7c f8 7d f4 3f 12 31 fa 35 7a 9e 21 8b c6 12 b3 9b ac 82 3c 6d bc 7e 53 42 a2 93 ed 9c a8 0f 47 c8 26 a9 af 1b 82 Data Ascii: PK-`mzYW/AgentPackageTicketing/AgentPackageTicketing.exe(H@eRlbkSbo&7o65\|>B8+C8*cj0f)El_wlERL,\|}?15z!<m~SBG&
2024-12-12 10:17:16 UTC	16384	IN	Data Raw: bb 01 f9 db d0 f2 fb d2 45 2d e4 3a 87 8c 65 76 b1 8b 4a 61 24 2e d7 41 54 40 9e 51 6d c8 13 f1 22 a9 c8 0f f8 db 6e 18 79 84 dd ee 52 00 1f 64 29 7b 70 b6 81 1e 50 ff b6 ea c6 15 4c b6 0f bb ef 8d 2c f2 f0 71 86 d9 c8 8f d4 52 63 6a 58 0a bc 7f 1e 21 8f c0 15 5a 32 89 d0 ee 7c cf e4 ba 92 71 f3 d4 f9 e7 cb 40 15 cb 13 68 af 8d 68 a0 94 d0 5e 2c 82 c6 07 7e 5c 6e c2 b1 f7 74 ae cd 15 9f f1 da 21 92 25 a1 79 4f 52 6e cf 6d 24 32 b2 30 ef 4c 9e f9 d1 fc 1f a4 fc 09 cb 07 19 a0 f1 64 4c c4 33 eb 2c 96 bf c1 36 2d 63 c2 29 24 85 e2 7d da c2 73 a0 01 8b 11 8f d8 71 d2 2b 5f e7 28 ea 10 78 79 07 5d ec 99 e9 09 16 a8 e1 02 84 09 2a 33 4f fc 15 65 29 09 ba 31 37 db d0 4e 31 ee 2a b3 a7 13 d9 c6 e3 fd 5f 8d b1 97 e9 67 40 ec cb b7 f3 55 5e b7 57 21 a2 0f c1 79 e8 Data Ascii: E-:evJa$.AT@Qm"nyRd){pPL,qRcjX!Z2\|q@hh^,~\nt!%yORnm$20LdL3,6-c)$}sq+_(xy]3Oe)17N1_g@U^W!y
2024-12-12 10:17:16 UTC	16384	IN	Data Raw: 28 1f b1 f7 a3 a2 f4 98 53 82 1b 3f 20 24 c2 d1 4c 45 bb f2 fa fb 0c c0 11 84 f1 68 d5 34 39 f7 d2 2f cc d7 bd c0 8a 7f dc 3a 37 ea b5 dc 05 dc c2 c7 b9 5b aa 07 55 57 05 ee 8f 7e c8 86 39 30 46 78 b0 73 8c 86 ef 2a 11 00 ae 68 29 7e b4 19 ec 42 0d 49 c2 ff 4a b0 16 24 ce 43 25 cb 96 38 c9 be c1 d8 84 34 2c 43 ab 0c 02 6b bb c1 4c e9 ff 76 dd 01 b3 72 aa 1b 39 8a 86 4e 4e ec 75 d8 fd 66 2c d2 6c 61 f8 57 a9 ad d3 37 5a c9 e2 10 4e 1c 90 50 d6 d1 b4 3f 8e b8 88 e9 0c 98 47 8a 72 18 4b 0f dd b0 fd f9 88 5c 65 5e a3 d1 42 44 91 32 91 6d 13 b7 24 ac 42 f3 3c 66 58 7d b7 28 3c 0c ef 13 f0 dc 25 62 49 7e f7 36 e6 0f a8 46 6d 78 fc 8c 69 d6 99 0f f5 29 d8 da b3 2e 99 ca 75 0c f0 e8 ce 67 9d df f7 9c 9a e0 53 a1 48 e5 da 99 59 17 b5 14 66 5d 6d 50 77 4d 0a 08 8f Data Ascii: (S? $LEh49/:7[UW~90Fxs*h)~BIJ$C%84,CkLvr9NNuf,laW7ZNP?GrK\e^BD2m$B<fX}(<%bI~6Fmxi).ugSHYf]mPwM
2024-12-12 10:17:16 UTC	16384	IN	Data Raw: f2 f5 bc 1d 7f f4 cb 9f ba 98 ad 52 28 84 40 6a 23 96 3f aa b7 67 3c 6b 5b 86 34 42 69 21 ec 38 57 5e 2d 2c e6 9e 33 1d e8 59 fd cd 7a a9 48 5a cf 10 c2 5b 75 ed 1c 3a e3 af c9 e4 77 e7 1a f6 ed 94 f6 1e 49 7d eb 61 7d 86 2b 4e f3 d0 7a 26 bb 95 e1 4d 8b 62 10 96 7c 2c 26 f0 0e 04 32 25 5f 0c b9 60 c1 5b af e5 1a b5 b6 29 a9 cf 02 95 b3 11 36 4b 42 f9 8a 72 9a a5 0e 84 ca 06 de 44 69 b9 c6 1d 5e d0 0c 9a e5 f9 b4 e1 bf c0 a4 17 7e 28 d3 bd 5c d7 84 d7 0d 97 26 55 4b ab 2b 04 dd c2 82 d2 ea 9d da 7a 09 0a 42 37 32 b3 8c 37 56 f0 09 15 ff f5 ce e5 5a 1a c7 30 41 cb db 99 2d 6a a0 db b9 3f 27 8e d3 25 06 73 95 b7 7f fc 86 fc 05 22 00 ad 02 01 b7 bb 55 42 17 6f ee a2 d8 2e fe 8b 2f 25 31 08 16 c6 36 d6 19 de ca c0 b7 1d f7 e5 a3 93 60 db 1d 3f af ee 8c 7e ff Data Ascii: R(@j#?g<k[4Bi!8W^-,3YzHZ[u:wI}a}+Nz&Mb\|,&2%_`[)6KBrDi^~(\&UK+zB727VZ0A-j?'%s"UBo./%16`?~
2024-12-12 10:17:16 UTC	16384	IN	Data Raw: 06 b2 75 9b 76 10 a6 31 12 63 27 50 8a 27 be 8e 40 bd b9 47 48 13 e2 85 70 5c 68 2d 38 85 e4 a6 5e e8 ba 56 a0 d0 65 6e 4d 43 28 e3 b6 ae ba 63 8b f0 7c 0a da 99 71 91 10 6d b7 7c 2b f8 f6 1d 40 3a a2 89 3a 03 55 fa ba d7 7d 0b 96 b6 5c a4 24 14 5a 7a a8 45 5c a5 a8 91 bd f8 34 58 23 35 63 4c 4c ef 1b 8a 83 0e b9 01 e4 25 27 4a 0a 20 30 8c eb 8a b4 44 d1 71 bf 2c cc 2f 3c a6 4b f8 8c 11 96 e5 df f6 e0 1f 07 f2 17 bd 0a d2 27 8b 5c 56 e0 fa ec bb f7 cd bc f4 bf 8a 83 f7 0e 27 c9 f5 4c d1 00 2f 04 04 21 20 3a 7b 82 76 c0 44 be b4 c7 d4 09 e9 b2 6f 4a 08 87 50 08 9e d2 12 bf 67 6e 45 85 c3 5e 3f 7e fd 1b dd 56 1b 85 65 74 a7 bb 5f 21 6b 18 ff eb a7 0b 90 d7 37 db 8c 4a f8 8c 24 11 6c c9 6e 44 df 0c f2 26 af eb c4 07 47 76 40 d3 4f db 65 80 54 94 20 c4 3b 14 Data Ascii: uv1c'P'@GHp\h-8^VenMC(c\|qm\|+@::U}\$ZzE\4X#5cLL%'J 0Dq,/<K'\V'L/! :{vDoJPgnE^?~Vet_!k7J$lnD&Gv@OeT ;
2024-12-12 10:17:17 UTC	16384	IN	Data Raw: b7 07 44 6c ef f8 dd 57 bc 3a 94 74 03 bc c7 b1 82 43 d7 ca f2 5b cb e3 41 b7 e9 66 65 e4 22 29 1e f5 17 80 ea 28 a1 55 a0 44 96 7d 4e ee 7b ad 0a 9b a3 c3 17 26 16 91 9b d7 00 af b2 25 80 11 47 93 f0 1d f6 6a 95 3e bd 00 7a d4 6f 19 0a 4c 14 68 b5 5c 6c f0 5b 0c c9 b5 98 85 35 66 56 c1 ba 84 31 88 8f 59 20 1c c4 b1 46 10 f0 5e 14 f4 41 df 26 08 0c 31 7d 05 40 df 8c b0 40 ed 11 60 3f a2 43 08 c1 cd 6d d0 e9 83 5d fa 02 1b 63 74 3b 01 19 4b d1 b6 dd b4 c5 0c 4e 50 38 6d 5c ae 27 94 93 a4 62 99 12 3c e8 fa 2a ea 23 41 bc 80 a3 b2 f0 0d 97 c0 7d 73 dd 6e 30 4a f0 53 2f 83 9e ca 5d ba fa 79 03 1e c2 2c 75 1c 81 b4 47 32 19 dc 47 86 f3 37 17 f1 06 c6 80 43 a9 d5 7e a1 00 82 8f 57 83 32 2c 65 62 16 93 88 5b e5 c6 6d 43 13 4b 28 9f 2d d1 e4 2e 55 a4 b9 e2 6d a4 Data Ascii: DlW:tC[Afe")(UD}N{&%Gj>zoLh\l[5fV1Y F^A&1}@@`?Cm]ct;KNP8m\'b<*#A}sn0JS/]y,uG2G7C~W2,eb[mCK(-.Um
2024-12-12 10:17:17 UTC	16384	IN	Data Raw: 2e 5f 18 c6 f6 db 9f 96 cc c2 ac cd 7b 25 e0 57 c1 3f a9 fd c7 7b 43 ee bd 8c 72 ef 7a 1a bb 30 f0 ef 9f 70 e5 9c 45 b8 38 2a 79 fa 5e b1 10 e4 89 a9 1a 15 a5 67 1b bf 36 36 82 07 48 0c 25 c1 49 8c 12 d7 47 7f 2b c0 e5 dc db f3 a3 b9 f7 a2 67 66 b9 4b e4 d3 d0 71 03 f1 5c 04 97 32 df 62 9c 51 05 91 ae 92 fb 7d d4 eb eb bf 0d 3d a5 85 9f cd e9 7d a0 66 ae 81 81 23 ca d2 91 02 72 91 fb 43 5a a0 13 b2 7a ce 37 4c 5e f7 5f 7e 5c d8 4a c8 a2 d7 d6 c7 68 d7 b6 f6 99 9b c4 be 51 31 8e 78 d8 c5 57 08 c5 12 73 0f 6f b0 f4 dc 6f 1b 96 47 30 cc c5 10 9b 2f de b5 aa 8a d9 cd b2 90 b9 e3 1e 98 54 dd f2 85 2f c3 21 e6 f5 cf 26 01 b8 ce 47 04 1e b1 b0 6f 4d 42 29 83 6d 65 02 66 23 b9 f3 34 68 eb ba ad b0 04 1f 35 43 0a d4 7e a1 af 98 ae ad b5 ca 93 0c cb 92 b8 54 52 58 Data Ascii: ._{%W?{Crz0pE8*y^g66H%IG+gfKq\2bQ}=}f#rCZz7L^_~\JhQ1xWsooG0/T/!&GoMB)mef#4h5C~TRX
2024-12-12 10:17:17 UTC	16384	IN	Data Raw: e5 cd 87 ba f0 e8 42 12 5a ad 2e fd c4 0b 69 61 1a c1 9c 4f 38 cf 6d 3f 1b 8c 1f 17 77 e9 6d 04 31 69 7b af 63 2e 2f 6b a2 1b c2 68 c1 84 3c 53 5f de 24 a6 b3 6e 71 b3 4b 6a c2 91 39 cb bb 1b 19 bb 98 e7 8b bb 52 ca 56 bb 20 e5 d0 80 d9 bd b4 2c 00 9f d6 e0 43 d4 d1 38 c4 2c ee c8 59 a0 bc 31 5b 81 50 34 95 5e 22 c2 66 be a8 8b 9f 4f 0a c6 64 5c 02 a6 22 6d 19 4c a1 43 ed 70 e4 05 2e 0c 88 7e bd b4 80 72 79 68 fe 8c db b5 ed 7c 7c fc 33 14 77 cd a4 0a 06 98 50 88 56 58 c7 e8 06 88 ec b2 09 80 47 0e c4 a0 56 3b 3b 82 da 44 24 97 4c 17 4c 2a 5d 3e 1d 49 b4 a9 15 c5 f2 d1 da e9 eb bb 52 9b 03 f5 a3 8c fd 6f 77 b1 84 42 e8 c6 4d 17 65 7c 83 5a 98 4c 5b 7c 23 71 44 fc da c3 2e 39 cc 1d 18 e1 20 dc 70 08 f4 79 ed 9f 65 29 13 c7 06 5c 60 e9 ee 80 5f d0 6c 1b 05 Data Ascii: BZ.iaO8m?wm1i{c./kh<S_$nqKj9RV ,C8,Y1[P4^"fOd\"mLCp.~ryh\|\|3wPVXGV;;D$LL*]>IRowBMe\|ZL[\|#qD.9 pye)\`_l
2024-12-12 10:17:17 UTC	16384	IN	Data Raw: 7e d6 f7 9a 33 1f 29 22 46 dc cc 75 e0 dd 05 f7 98 71 92 ca 32 a8 c2 a0 33 67 92 f9 b5 ec 57 be 7d fd e2 40 74 69 8f 6a 84 c1 29 7e 26 32 21 42 5f 71 da 5f 71 74 6e 00 f6 6f 0d 18 ea f5 ae 4e de c0 85 c3 b0 41 8d ec 3b fd 82 9c fb 0d 30 00 a6 7b 39 88 e7 f3 56 93 f0 f5 b6 cf 07 f8 04 74 a0 58 8f 37 1d c2 45 79 5e 06 98 a5 ac 0f 19 84 11 fb 25 b5 97 e2 e3 6e 5b 36 3f 68 6f 8d 5c 7c a6 70 db 48 3a 3d e5 0a 24 63 d6 d2 7f 13 69 84 9f e5 e7 27 6a 1a dc f5 ca a4 93 f6 80 39 ca 24 70 17 d2 32 e3 fc f8 09 df c9 75 c4 c2 08 f1 ca 7d 4c bb d7 a1 0a a9 63 98 01 09 0d 10 7a ab 3a bb be 98 11 e4 85 06 11 8a 84 a0 b8 9f 8a 6c fa 4a ef 1e cc bc f7 13 3e 70 19 a8 a7 a1 57 7f 8b 18 1a 20 74 3c 53 99 68 4b c9 d3 64 74 b0 32 33 1d 0e 31 68 f7 19 71 b6 ac e3 80 96 42 9e a8 Data Ascii: ~3)"Fuq23gW}@tij)~&2!B_q_qtnoNA;0{9VtX7Ey^%n[6?ho\\|pH:=$ci'j9$p2u}Lcz:lJ>pW t<ShKdt231hqB
2024-12-12 10:17:17 UTC	16384	IN	Data Raw: 56 0a db 55 d4 f5 92 8e e2 65 54 01 25 fe 7d 1c 94 d9 ec b9 ae 20 bb b0 22 72 f6 e8 29 69 c4 99 2a 47 af 07 8b 86 0d 28 cd c3 a6 5e 98 e1 d1 48 0a f3 d3 c4 4f 89 33 30 22 83 c3 85 2a 7c 90 74 f8 e2 22 32 1d b3 07 fb 84 a2 2c 10 ac c9 a6 b0 07 84 9a 48 57 5a 64 1e 88 13 fe 22 0f 90 86 a5 2e 60 5c d2 c5 56 95 bd 85 5d c1 34 74 92 d0 e5 19 5d 48 92 4a a4 3c 1b b6 8f d0 84 c8 68 ff 5e 1b 2d 61 81 69 32 9e 56 b7 a9 07 ac 5c db 41 50 03 87 4f 07 f7 a9 25 8b 8f a3 0c 86 79 c5 19 aa 43 e8 b7 40 d2 fa 5a d7 32 44 70 89 d1 f7 b5 ec 8d 67 ae e2 34 57 0c b1 58 7d b2 5e 25 1f 1d 73 d4 c1 0f 0b aa 6a 50 98 e7 20 9f 08 b1 58 46 0d 88 0d 88 78 c6 99 4e e4 74 f7 6d c9 c8 3f 6e 6b 59 85 9c 5d b1 4a a3 fb 25 e3 fc 8f 28 7d 39 98 29 5e 93 69 8e c3 fc 9e 8b 26 cb 93 7a d0 96 Data Ascii: VUeT%} "r)iG(^HO30"\|t"2,HWZd".`\V]4t]HJ<h^-ai2V\APO%yC@Z2Dpg4WX}^%sjP XFxNtm?nkY]J%(}9)^i&z

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	50024	13.232.67.198	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:17:16 UTC	358	OUT	GET /v2/presence/sub_key/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/channel/14216fa6-dc15-4519-acf9-f0e1b34954b6/heartbeat?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=4d6591bd-1bc5-4e62-8d3f-8d6db221fd28&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com
2024-12-12 10:17:17 UTC	323	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:17:17 GMT Content-Type: text/javascript; charset="UTF-8" Content-Length: 55 Connection: close Access-Control-Allow-Methods: OPTIONS, GET, POST Age: 22 Cache-Control: no-cache Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:17:17 UTC	55	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 20 32 30 30 2c 20 22 6d 65 73 73 61 67 65 22 3a 20 22 4f 4b 22 2c 20 22 73 65 72 76 69 63 65 22 3a 20 22 50 72 65 73 65 6e 63 65 22 7d Data Ascii: {"status": 200, "message": "OK", "service": "Presence"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	50022	13.232.67.198	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:17:16 UTC	159	OUT	GET /time/0?pnsdk=NET45CSharp6.13.0.0&requestid=c2c17224-f7a0-412d-95aa-51f8282229db&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Host: ps.pndsn.com
2024-12-12 10:17:17 UTC	242	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 10:17:17 GMT Content-Type: text/javascript; charset="UTF-8" Connection: close Content-Length: 19 Cache-Control: no-cache Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: *
2024-12-12 10:17:17 UTC	19	IN	Data Raw: 5b 31 37 33 33 39 39 38 36 33 37 31 30 35 34 33 35 34 5d Data Ascii: [17339986371054354]

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	50036	52.222.144.9	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:17:19 UTC	174	OUT	GET /agentpackagesnet45/AgentPackageOsUpdates/20.9/AgentPackageOsUpdates.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1 Host: ps.atera.com
2024-12-12 10:17:19 UTC	672	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 2950275 Connection: close Content-MD5: p78NqOMIJIrv1pWG4fijEg== Last-Modified: Mon, 18 Nov 2024 07:50:46 GMT Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 42d56f16-301e-003b-1192-4b386e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Thu, 12 Dec 2024 06:04:49 GMT ETag: 0x8DD07A5B60588D0 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c7f8b6507c2a4a5ebea5d7ec809ae182.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MRS52-C2 X-Amz-Cf-Id: 99zTA92-CyNf23QMYMmx_c4HcHdPK1h-NiPUDO2InioTCi0HmCK-kA== Age: 15163
2024-12-12 10:17:19 UTC	15712	IN	Data Raw: 50 4b 03 04 2d 00 09 08 08 00 53 3e 72 59 f8 80 4a fa ff ff ff ff ff ff ff ff 36 00 14 00 41 67 65 6e 74 50 61 63 6b 61 67 65 4f 73 55 70 64 61 74 65 73 2f 41 67 65 6e 74 50 61 63 6b 61 67 65 4f 73 55 70 64 61 74 65 73 2e 43 6f 6d 6d 6f 6e 2e 64 6c 6c 01 00 10 00 28 72 00 00 00 00 00 00 4d 3f 00 00 00 00 00 00 42 9a c8 8a fc c9 f8 5b 0a 3f 9e cf 0a ff fe b6 04 04 e9 f1 c8 5f bf c0 e8 eb 92 f8 40 ce dc 14 51 c1 b2 77 00 7a aa bd 68 fc 71 b6 ed be 68 56 99 a6 e5 40 24 74 d6 63 b9 2b 35 86 8d f5 f1 b4 a1 a8 60 69 5a 19 ad 1c 23 cb c5 c4 1e 11 5a 97 9b 5e bf 36 8b f2 f2 c8 d3 c8 f9 95 db d1 be d5 9a 9e b9 48 fe 22 b8 e6 b6 e4 8a fb 34 72 77 69 27 5a 7b 52 29 cd 97 73 a3 ab 6c 31 57 de 89 ba ee 2b 1b 77 73 56 c0 f9 e1 f4 79 12 20 3c 24 4d d9 a2 b2 13 66 0b 97 Data Ascii: PK-S>rYJ6AgentPackageOsUpdates/AgentPackageOsUpdates.Common.dll(rM?B[?_@QwzhqhV@$tc+5`iZ#Z^6H"4rwi'Z{R)sl1W+wsVy <$Mf
2024-12-12 10:17:20 UTC	16384	IN	Data Raw: 81 b4 41 0f d9 f5 b1 e7 a9 30 85 b0 84 e9 e4 dd e5 6c c4 b3 15 c1 3a 7a 34 b6 8e 4e 91 68 e9 ef 11 ef 3d a6 78 05 9d 38 1b 32 74 78 8b 94 10 cb 82 da 12 0f 85 58 82 f9 a5 46 f8 a6 2f 34 23 45 3c c4 73 53 64 50 f9 91 95 2a f9 fe 67 93 0c a1 0b 79 3b c2 cc 24 d9 4f 06 1f 90 7f 51 c4 ea a2 0d a2 b6 77 65 34 de 5c 5f a2 56 ea 88 75 2a f0 b3 72 b9 be 0a 8a fe b4 d0 ba 27 4d a7 a9 3a 34 12 7b 39 4e f4 42 f5 77 2a 38 3d db c1 e4 bf ae 4a 8b ff 54 b4 3b f9 b7 91 36 fb 94 49 f2 ad d8 7c b2 e2 2e 1c ed d5 76 26 28 ce 61 9d 05 af 92 d0 13 0b 9d bc 52 55 70 3d d5 1b 23 83 71 df e3 88 99 7b 5d f1 7c 03 a4 2b e8 be 52 84 c0 25 db ce 66 1e 84 b5 1f e6 16 cc c8 66 5c aa ac 1b 30 51 bf 37 03 7f 39 9c d6 36 1c e0 51 3e 10 c9 2d da 75 31 96 e9 82 78 74 54 a2 fe c6 12 b5 aa Data Ascii: A0l:z4Nh=x82txXF/4#E<sSdPgy;$OQwe4\_Vur'M:4{9NBw*8=JT;6I\|.v&(aRUp=#q{]\|+R%ff\0Q796Q>-u1xtT
2024-12-12 10:17:20 UTC	16384	IN	Data Raw: 05 8d e6 e1 d7 20 6b ce 7e 3f 81 07 bf 65 6f 43 6f 48 07 a3 2c a4 0c 26 dc 6e 13 1b 86 84 c7 af 36 de 3d cd 1f 8b 42 0d 91 65 06 9c 9e 57 cc 98 b4 9c cc 60 9a 66 db 2c 4e b5 85 f5 c6 7f fe 47 4e d0 2a 94 63 8d 89 2b 72 e3 d1 c1 c6 18 ca 6a 91 b4 56 07 be c1 c9 74 35 a1 33 aa 1a 1d e7 4e 1a ec 54 d2 0a 79 fd 60 cf cb e1 bb 0c b0 e2 01 37 f5 6b 16 ae e3 d2 12 43 c3 47 2f ee 9f 33 88 18 10 ab 55 5a 2b c6 b4 9f 4b 64 6c 7c e4 ff dc a7 ff 0f cf b5 15 32 a0 af 6c 25 9f 47 8c e5 d5 85 81 4f 22 82 ad 8d 08 9e 5e c2 c3 3a 80 53 8b 2c 11 ca bd 8b 1a 23 4d a6 ac db 85 c8 98 36 d5 5d d7 c2 04 da eb 72 4b 2c 2f b4 8c bd 7e 37 dd ba 25 24 ac e8 b2 25 08 75 1c b9 80 18 e2 29 8b 29 df 3d ee 2f 88 42 5c 2d 8a cd 3e 9a 1d fa 19 a7 db 39 40 26 3b 64 f7 71 65 02 ed c2 8a 37 Data Ascii: k~?eoCoH,&n6=BeW`f,NGN*c+rjVt53NTy`7kCG/3UZ+Kdl\|2l%GO"^:S,#M6]rK,/~7%$%u))=/B\->9@&;dqe7
2024-12-12 10:17:20 UTC	16384	IN	Data Raw: d0 08 e2 86 14 dd e1 12 32 97 99 4d 50 81 73 bd 3b 2b 9b 68 4a d0 1c 7c c2 ce 5b 6c ac 67 37 8e 9e 8a 88 ef 6f ad 38 41 7e 01 ed 32 21 94 18 98 63 34 3b 11 b4 d7 bb 0d a6 56 46 c1 08 1b 82 d6 a6 d9 8d 8c d7 8c 67 e7 06 51 2e 04 7f ef 80 3e 55 b8 99 39 c3 8a c1 44 13 b8 2e 5e 2f a3 53 6d bc 0d 86 27 64 d3 e3 46 e8 d5 9e 64 1f 3c a1 90 91 51 1e 07 28 6f 6e f0 c2 7e e5 61 aa 16 29 cb a5 ef 2e c7 b8 0f 2e de 3d bb 93 90 f0 ad c7 cc 4e 84 a6 f1 ca a1 b5 74 73 7a a3 2a 5b 13 47 7b 61 72 49 38 aa 9c c7 64 d8 68 80 a5 bc 3a da b1 d7 8b 66 fd c4 17 12 5d 8c f9 b4 11 15 ed cd ae 3a dd 86 fe 57 e9 2a 84 b1 01 27 c7 1f 47 f4 55 7c 82 a3 a8 96 6d 21 21 b5 54 9e 7f 05 ac de 95 c7 f3 21 5c a8 43 7a 1e e5 a3 7c 1c 41 a8 77 53 6d ba 8c e0 ce 5f 08 69 e0 e4 0a cf 3f b8 cf Data Ascii: 2MPs;+hJ\|[lg7o8A~2!c4;VFgQ.>U9D.^/Sm'dFd<Q(on~a)..=Ntsz[G{arI8dh:f]:W'GU\|m!!T!\Cz\|AwSm_i?
2024-12-12 10:17:20 UTC	16384	IN	Data Raw: 0f a6 31 f5 2c 31 cf a7 f7 93 25 6c ac 03 0d ca 06 e7 f6 45 a9 7a b8 0b 96 a2 5b f0 50 52 54 b8 e1 2b 77 41 f7 af fe 96 a4 4e 92 90 37 0c 9b 9b 7a b5 91 96 01 65 6a 3c a1 3c 6c 02 1a 29 f0 ef ae 44 a5 45 ac 63 31 59 17 04 89 39 16 58 dd cb 7c 21 06 42 b0 dc 6e 24 c8 b9 a7 ea ea 03 38 73 00 2b dd d1 b4 f1 8d be 45 b2 96 13 76 01 7d 8d 46 cd a2 06 94 d9 55 4f 26 61 91 64 ed 62 45 a2 60 6b de 30 ae 24 4f 17 86 47 7e 11 a2 4e c7 80 5b b5 a1 5d f6 98 3a f2 97 d8 78 1b a4 bd b6 dd 76 f7 16 17 29 b4 cb 67 29 f1 72 44 77 31 a5 56 01 55 08 55 61 1b c4 0b fe d9 f4 b5 f3 2a f9 9d 16 8a 76 ea 8c 13 97 82 94 ee a5 39 00 63 a0 4c 78 cb b2 cf d0 85 75 88 a1 cc 52 39 e5 43 8b bf 75 3c 30 a1 bb 06 e0 ea 7e 56 60 60 a7 78 11 15 6b bc 44 5f 8f 8f 0a 76 75 30 fb a7 54 b2 8c Data Ascii: 1,1%lEz[PRT+wAN7zej<<l)DEc1Y9X\|!Bn$8s+Ev}FUO&adbE`k0$OG~N[]:xv)g)rDw1VUUa*v9cLxuR9Cu<0~V``xkD_vu0T
2024-12-12 10:17:20 UTC	16384	IN	Data Raw: 54 ff 87 82 63 e6 76 f2 97 14 d3 10 aa 71 06 39 ee d5 a9 7d bd 05 c5 42 8f c1 fd 62 44 bb 95 f7 0b 42 98 da fa 7c 01 3e ad ee 1a 33 b9 83 c8 45 2d 4a 63 0d 40 58 10 4e e7 c1 77 53 c3 e1 b7 2f a5 05 a4 44 77 05 a3 40 4d e6 d0 23 30 7d 4a 33 af 59 e3 23 f9 6e 69 d7 29 77 cf 73 b8 88 3b ab 5c 14 85 e0 d0 3d 7b 1d 19 59 db bc e7 94 18 c7 67 ef 23 c5 47 3b 91 8c 9f c0 df a4 ae 76 b8 71 8c eb d1 0b 78 b9 58 c1 16 ca 80 7d 60 9d 44 9c 69 83 8d 6d bd 79 3c 07 cf d4 41 6e 23 90 60 ce e0 60 90 a8 10 48 c4 3f ec 41 ee 3f e5 ee 40 bf 2d 1e 95 2e c2 9f 25 20 f4 b3 ed bb 37 0c 64 59 05 c7 42 99 35 4d 6c ac a1 5c 01 10 2a 74 ef 7e cc a0 bc 9c 50 bf 30 dc 37 f8 37 f3 74 77 72 43 68 cf c7 fd f2 d1 1d 9f 6e 0e 3e 23 4e ba 83 9f d0 b4 5f 42 ea fd 4a 8a 4e 04 39 8b 43 38 3f Data Ascii: Tcvq9}BbDB\|>3E-Jc@XNwS/Dw@M#0}J3Y#ni)ws;\={Yg#G;vqxX}`Dimy<An#``H?A?@-.% 7dYB5Ml\*t~P077twrChn>#N_BJN9C8?
2024-12-12 10:17:20 UTC	16384	IN	Data Raw: 16 06 fe d8 ce e4 36 e0 4d 90 49 2f d1 38 e2 0b cf 42 b0 ca bc c3 b6 0b f8 30 b3 64 9f b8 d0 4b ec e1 99 8c 1e 2c 44 8a bc c4 28 e7 3a 47 b5 26 1b c8 66 6d 04 f8 af ed 89 1e 21 9b ad dd 57 ef 33 6d e7 62 b6 44 34 f8 a9 c6 c5 8e d7 1b 2f 20 5d 93 0a 9c 85 ff 85 19 7d 51 b4 ba d5 8b bf 04 67 5e 61 1d fd 7c 52 91 d2 6b 46 9b 43 3c 97 06 c8 96 f5 5c 74 ae 5f 8d ce 63 49 b5 b5 55 95 52 4e 56 70 8d 0d 0e ff 37 e6 c7 3c 46 f3 98 28 41 d8 f9 65 5e 3e 63 ad 78 d9 66 20 e7 a7 05 0b 2d 1c d6 1c 38 16 0a ba 00 98 c1 e7 1a 79 ba 67 72 df 39 9a a7 05 91 f3 98 63 e0 41 f9 d2 ba 9d 66 2b 2f 7b a9 03 df a7 89 ab 59 35 a2 e4 b5 f3 da 94 51 cf f5 c5 83 5d 3e 48 5a 18 a2 67 0c fa 4a 61 ba 22 ec c7 eb 2d 8b db 97 41 ee 2e 5b ee 26 fb 86 56 54 c1 a0 05 09 71 a9 41 cb fc 07 08 Data Ascii: 6MI/8B0dK,D(:G&fm!W3mbD4/ ]}Qg^a\|RkFC<\t_cIURNVp7<F(Ae^>cxf -8ygr9cAf+/{Y5Q]>HZgJa"-A.[&VTqA
2024-12-12 10:17:20 UTC	16384	IN	Data Raw: 9f d9 97 b7 ae 71 e2 3b fa 90 1c ed be e1 be 88 f0 3e ed 9f 86 ad bd 75 e2 1d 5e b3 a4 b0 e9 21 03 27 fb 2d 51 de 94 3d 54 54 b4 90 72 6d 13 40 a9 90 ad e2 b5 fd 12 0d ff 77 87 86 49 a7 43 07 f0 6b 34 4b 13 0e b0 5b a6 b2 87 2f d9 64 6a a3 d7 e8 0f d7 f3 7b cf 27 65 29 e7 7b 8e 72 0e 74 f8 ce bd c7 90 35 96 47 9e 9a c9 6b 37 50 e6 bb a9 8f cc b2 2c e0 db 81 6f 2d a2 38 34 3a d3 51 c1 c0 01 67 3e c7 41 3a 6c fb 58 ac de 13 71 cd f1 80 2c 8b 1d 8b e4 98 71 4d e6 6d 29 cb d2 68 c6 07 d5 01 44 d6 ab 13 8b df c6 58 6c 42 0c 4c db 3c 38 9f 31 aa 98 af c8 19 80 60 58 35 79 62 c8 d7 94 8e 31 f0 87 42 95 49 a5 d2 af 05 08 b4 07 d8 fc 09 57 bb 56 2b b1 da e3 a4 d9 51 25 f8 83 7f 50 98 1c f7 25 76 fd e6 13 f7 eb 7f 6b 90 61 c1 b0 40 59 21 63 54 a2 1a da d7 98 86 cf Data Ascii: q;>u^!'-Q=TTrm@wICk4K[/dj{'e){rt5Gk7P,o-84:Qg>A:lXq,qMm)hDXlBL<81`X5yb1BIWV+Q%P%vka@Y!cT
2024-12-12 10:17:20 UTC	16384	IN	Data Raw: 56 52 7d e2 ad 68 43 a5 a7 d8 e0 a8 52 49 ff 29 4d ee e4 a3 9c 97 d2 43 a3 5f 98 de 63 f7 14 4e 27 4c fb 74 6f 5c ff e4 8f e5 22 3f 2f 5c c0 47 d1 c9 62 e9 10 1a fc ec db d2 45 ea 3f 0b 85 ab e4 5f 60 53 db 7a d4 03 aa 5c fe d6 02 2b d1 a3 a7 6d d2 02 9a ff d9 ae 91 13 4b 45 4a 43 28 c3 e5 b8 c0 77 af df bc d7 f1 83 18 0f af de b2 b2 c5 38 ea fa cb e8 7a c0 8b eb e9 34 7f 2e 06 48 47 4c 5c 72 af 67 08 6c 2f df ad 77 15 e4 8f 32 54 73 71 e9 40 e0 24 84 c4 8d ec 27 e1 98 dd d0 4c 92 02 32 bc e4 44 b3 6f 81 58 8d 30 fd 85 55 39 07 5c f5 86 c4 b1 84 24 7f 26 0e 48 65 c9 40 3b d3 f0 20 ec c0 25 c7 0e 0d 15 99 2c 98 f8 d7 1b 1b 69 72 c1 53 93 d3 fa 35 83 e0 dc 70 4d db f8 15 00 5c c6 f2 99 6e 84 8f 9b 4e b9 a0 5e e2 e4 60 01 73 db 81 fe 3c 74 21 17 5f d5 6a 4e Data Ascii: VR}hCRI)MC_cN'Lto\"?/\GbE?_`Sz\+mKEJC(w8z4.HGL\rgl/w2Tsq@$'L2DoX0U9\$&He@; %,irS5pM\nN^`s<t!_jN
2024-12-12 10:17:20 UTC	16384	IN	Data Raw: 34 68 8b 81 82 8a 89 a9 65 b6 08 9e c6 61 16 84 4c 3b 26 9b 4c f7 3d 13 9a 54 3a 96 c3 a5 8a 29 0f 49 0e 39 2a 89 2b 9b d5 d6 0c 25 55 83 11 49 9a 62 9e 89 57 d8 95 0c 18 d8 4c c8 5a 87 e2 35 a5 49 92 56 5b f4 9b a7 3c 62 e9 eb 7e 9a 5a b2 10 68 74 00 02 df a0 29 aa 6d 3d 04 53 78 76 26 3b 20 e4 42 e1 9b 0d 2a 10 21 5b fb c3 3e a8 4d 3e b2 47 a5 15 dc ba 56 0b 27 7c 09 68 9f 20 17 e7 32 e5 4d d3 08 80 5b 14 9c 9c 16 37 0c a9 a2 c8 7d 94 c8 f9 e2 c6 51 93 f9 78 a0 26 5b ec 31 da 49 1a 29 aa 03 e5 2c e7 79 06 13 ba 03 b6 20 86 ae d1 76 19 d5 39 63 e9 dd e2 cd fd c8 d6 65 51 70 0b 2a 72 d3 0f 5d 22 0b 5d 14 67 21 9c a4 b1 a1 a3 d8 18 6e b0 55 a3 ca 35 86 6a c1 bd b9 33 7d 77 9b 0a dc a8 86 b0 2a 90 65 39 ff 44 5b df 21 a1 bd db 4f 36 b2 4c 48 c1 91 32 16 84 Data Ascii: 4heaL;&L=T:)I9+%UIbWLZ5IV[<b~Zht)m=Sxv&; B![>M>GV'\|h 2M[7}Qx&[1I),y v9ceQpr]"]g!nU5j3}we9D[!O6LH2

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	50032	13.232.67.198	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:17:19 UTC	362	OUT	GET /v2/subscribe/sub-c-a02ceca8-a958-11e5-bd8c-0619f8945a4f/14216fa6-dc15-4519-acf9-f0e1b34954b6/0?heartbeat=93&pnsdk=NET45CSharp6.13.0.0&requestid=9c4570a7-328a-4212-a79a-2c397f40b099&tr=31&tt=17339985948483535&uuid=14216fa6-dc15-4519-acf9-f0e1b34954b6 HTTP/1.1 Cache-Control: no-cache Pragma: no-cache Content-Type: application/json Host: ps.pndsn.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	50045	52.222.144.9	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:17:23 UTC	190	OUT	GET /agentpackagesnet45/AgentPackageProgramManagement/26.3/AgentPackageProgramManagement.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1 Host: ps.atera.com
2024-12-12 10:17:23 UTC	672	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 3024278 Connection: close Content-MD5: eAXqGo3RXKwyi4Ju/jjCqQ== Last-Modified: Thu, 14 Nov 2024 08:52:38 GMT Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: a2443d0a-401e-0021-6675-4b59b1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Thu, 12 Dec 2024 02:37:00 GMT ETag: 0x8DD0489B13E2445 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 cad42ad8223e04d99ff047e13149db54.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MRS52-C2 X-Amz-Cf-Id: QXznEkzfgOwBkpB-5I2zhcgbCKunj6RBPuoPHnhouE21XcaFFmTEiA== Age: 27654
2024-12-12 10:17:23 UTC	15712	IN	Data Raw: 50 4b 03 04 2d 00 09 08 08 00 8f 46 6e 59 90 ef 3d 9d ff ff ff ff ff ff ff ff 3f 00 14 00 41 67 65 6e 74 50 61 63 6b 61 67 65 50 72 6f 67 72 61 6d 4d 61 6e 61 67 65 6d 65 6e 74 2f 41 67 65 6e 74 50 61 63 6b 61 67 65 50 72 6f 67 72 61 6d 4d 61 6e 61 67 65 6d 65 6e 74 2e 65 78 65 01 00 10 00 28 e0 00 00 00 00 00 00 a8 6e 00 00 00 00 00 00 42 40 66 0c 65 70 99 fb 4c ba 83 2b 7a 5b 3b 72 86 c2 0b 45 37 c1 78 85 00 72 fc fd 8c 4c 9d f6 1f 55 2c 38 67 53 61 fa 32 36 cc 0a ac 9e cc 10 5d 38 2e 0e a4 7c 1a fb 93 a8 da cf d5 71 9e c8 3e f2 de dc 6e 2b 2c 5d 1d f6 91 2e 52 2b 98 96 4c 0a ec 11 d1 75 b0 5e 18 ce 24 64 69 cc 78 4b 51 14 51 2a 93 ee 57 b7 6c 9a b6 ad ca 82 66 92 a3 8e 83 69 35 51 c9 66 f8 31 dd 9f 95 1e 95 d2 e9 32 4c ca f9 af ff 34 ed ea 39 ca a5 41 Data Ascii: PK-FnY=?AgentPackageProgramManagement/AgentPackageProgramManagement.exe(nB@fepL+z[;rE7xrLU,8gSa26]8.\|q>n+,].R+Lu^$dixKQQ*Wlfi5Qf12L49A
2024-12-12 10:17:24 UTC	16384	IN	Data Raw: 33 ef 81 e2 55 70 23 5d 7a 62 32 b8 94 0c aa 02 c9 78 74 4b 2b af a6 3b b4 fd cb 57 4d 28 d6 6c b6 d2 7a df 18 d8 4c ba 83 38 69 68 81 3f 5b 6c df 3b 27 69 75 c3 46 12 6a 29 4d ac 9f db b0 77 77 1b 97 2f 2b 1c 6c e2 ab 4c 12 35 2d 99 be ff b0 74 66 48 5b 11 07 28 56 2e 1c 59 85 99 ce 79 8d b7 a7 1c 89 97 ac 4e bb 94 06 e8 c4 81 52 18 4a 0d 5b be 94 53 84 4d 47 17 30 bf ef c7 ac 41 3c 8f 94 f7 06 c1 2e 68 de 9a 34 31 4b 3f 2e c8 4e 78 3f 57 dd ab 98 97 af 21 76 0b 33 fc 5d 23 5d a1 8a 9e d2 6c a6 4e 12 1f ba d6 b0 ff 20 03 39 b3 72 73 ed c1 f0 d6 bc 4b 28 cc a5 0f aa 46 b6 d7 d7 ae 6d 84 40 df 48 6a 58 a2 ec 6a 63 14 90 79 93 6f 0f 91 5b 6f 2e 0a 2d 6f da 89 ce c7 11 33 48 f5 3e 0a 19 6a 6a 30 7f 79 c1 59 6f 75 db 08 6e fc b8 42 94 41 1d e7 a0 1d 8a 83 25 Data Ascii: 3Up#]zb2xtK+;WM(lzL8ih?[l;'iuFj)Mww/+lL5-tfH[(V.YyNRJ[SMG0A<.h41K?.Nx?W!v3]#]lN 9rsK(Fm@HjXjcyo[o.-o3H>jj0yYounBA%
2024-12-12 10:17:24 UTC	16384	IN	Data Raw: 80 3b a2 a2 42 36 8d c8 61 25 a5 27 cd 17 40 0d 62 6a 08 a5 c8 97 c8 4f 7f b2 9f 11 a9 0f db 80 dd 39 ec 0e d2 d4 f0 2a 17 f1 85 46 00 9c e2 0c f5 ca 99 ec 2b d2 d4 a2 6c 15 05 0d 73 0f 1f 63 32 9b f7 6d 9c 49 d2 db 0e 97 fd 61 33 38 9f d7 08 5d bb 0e c5 45 2d a9 ed 2e e9 60 d8 20 f6 b7 12 42 db 19 e5 5b 2e 8d b0 d2 b2 26 88 fe 95 4d e5 6e 7d 0f 5a 10 ed e0 06 1d 60 da 3f b4 b7 da 6b ff fe d6 c3 d4 ee b1 22 5c 90 28 29 e6 16 d0 8f 6f 4e 07 00 87 e5 3b 82 3c 9b d8 52 2c a0 bd 21 b5 6b b0 29 a2 7b fe 4f 29 28 0b d9 97 d3 5a 14 44 85 b6 33 be 4f 30 6b 14 27 15 9e 2e ec 83 37 ce 9f dd ae 1a 28 e3 cb 8d 3d 54 fc c9 7e a7 3e 6f 2d 57 77 66 d4 12 ab 6d 28 22 75 49 8a 42 f3 f2 78 68 19 63 0f ca 6f 0d fc a3 16 4e aa 9f c0 7d 4f e1 21 8f 0f 6b ad 73 2b 1b 7b 5b 7a Data Ascii: ;B6a%'@bjO9*F+lsc2mIa38]E-.` B[.&Mn}Z`?k"\()oN;<R,!k){O)(ZD3O0k'.7(=T~>o-Wwfm("uIBxhcoN}O!ks+{[z
2024-12-12 10:17:24 UTC	16384	IN	Data Raw: 75 49 8e a2 cb e0 aa 1f f1 34 dc 33 61 de 72 d0 be 2e 77 21 8d 83 bd 9e 39 12 74 fe ae 8a 77 2b 26 a5 ec 0e 9b 72 34 29 8e 81 03 91 98 a4 cb e8 2e 2d e2 10 d1 82 ec f1 8b 16 2a 69 83 f3 24 10 b4 6b aa 9b a9 83 7d 53 22 1d 2d cb 73 03 a3 52 50 9b 2e 32 73 12 63 e4 d5 56 7e 12 c6 26 9d b3 e4 04 95 39 a9 e6 08 50 53 b5 ff 2e f4 0d ac 25 ef c4 d8 fe ee 3a 7c aa 16 16 54 ad e5 07 cb a8 83 99 6e 2c f3 02 32 be 53 63 0a 37 90 b3 63 a2 6a 58 91 1e 50 96 2b 4d 92 b5 90 b7 aa 89 80 f8 57 67 46 4f 6a 48 32 8f 3e 6a 76 97 d1 d6 f4 f8 0f 77 a9 e7 dd 3f 27 67 04 45 fb db c7 e6 c8 2f 5d 02 fe 67 2e ff a8 4e 89 ad 09 2a 08 96 c1 48 f9 11 45 cf 36 c5 cd 57 d7 62 5e fa c5 ef 1a ee d9 b3 51 12 55 0e 1b b9 ad 61 3d 51 c3 86 0f 0f bd 29 be c8 9b 63 06 31 e6 9f 41 13 d7 76 0b Data Ascii: uI43ar.w!9tw+&r4).-i$k}S"-sRP.2scV~&9PS.%:\|Tn,2Sc7cjXP+MWgFOjH2>jvw?'gE/]g.NHE6Wb^QUa=Q)c1Av
2024-12-12 10:17:24 UTC	16384	IN	Data Raw: f2 bb 36 57 42 59 9c 1b c5 f4 4e bb 5c b8 07 3b 1d 3e 15 4e 24 d0 06 d0 a1 aa 0d 4b fd e7 cc a0 5f 2d 26 1b d2 0c bd 54 13 e3 72 55 5a 8c 2f 73 d8 47 88 1f 08 b7 db 4a b7 25 ef 83 49 bd c6 f5 e6 ee a1 d0 7e 2e 9b db 43 86 bb 73 2e 12 45 82 bc 89 da 2b 90 50 f5 cd 05 67 e8 c4 3d de 86 11 36 aa 24 24 33 23 aa 1d ba 2a 17 69 73 9a 5d ba 2d 41 46 8c 2d b1 23 5f 29 46 f4 98 3c 72 bd 66 4f d7 0a 6c db 18 3f 13 6d 1e 2b 59 80 77 bb 1d 08 27 09 7b d8 1e 87 fe 73 68 62 23 b1 d8 50 f3 41 9d e6 ae 6e 1a d9 bb 5d 02 a7 50 71 e4 6e 1a c3 41 bd f9 6c 3b a4 7d 6b db 29 2d d3 5f b4 f0 da f3 0a c5 05 5f e4 91 34 b1 b4 45 bb 22 12 9d a6 f1 8a 8a a6 fb e1 c9 61 0e 37 7b 41 56 0a 27 de 68 6d e4 b6 d6 ac e6 fd d5 75 b0 63 93 5d 3e 93 28 17 4b 6e d2 3d fd 06 20 a7 d2 40 5b 16 Data Ascii: 6WBYN\;>N$K_-&TrUZ/sGJ%I~.Cs.E+Pg=6$$3#*is]-AF-#_)F<rfOl?m+Yw'{shb#PAn]PqnAl;}k)-__4E"a7{AV'hmuc]>(Kn= @[
2024-12-12 10:17:24 UTC	16384	IN	Data Raw: 92 67 c0 a0 6b ae e7 52 04 3d 0d 16 e6 a2 06 2f 09 44 62 48 0a 07 4d b1 e0 44 8a 30 8b 22 2c 2e 7b 3c b7 4c bb b8 b1 74 91 22 67 19 ea 13 a0 4b 8b b5 c1 a1 21 f7 f1 1d 96 e7 eb 48 75 1f c8 48 5a ad 95 70 91 04 01 81 bf c0 0d ad a0 26 98 16 22 92 a1 cd 51 4b 80 02 a3 66 1f 87 49 cb e2 ef 20 a2 18 30 89 5b 9b 41 ad 2d ef 4a 38 e0 66 ce 6c 4d a7 73 0d 1e cd ca d3 02 84 c3 7e 44 0a 84 46 bd 1d f4 1e 6b d3 fe 5a 89 e4 0f af 76 fd a9 b1 ae 05 7c 96 ff ba 21 1e 90 c9 f2 85 c6 26 74 88 1c ed 61 f5 b6 f9 93 59 9c ab 1b 29 f4 e1 1d 6b 66 51 59 a6 59 4c c9 a8 58 c6 1f d0 5f 65 c7 ca 32 2c c7 4f b2 2e 7a 5a 44 e4 12 2d d9 ab 18 fc 96 47 3b 8b 71 07 b3 94 9e 1d 8d 18 57 49 f0 8f 5c 8b 2f 4d d4 85 61 2a d9 d3 1c 55 5c d1 f0 fb ad 9f 2a d7 71 54 d5 2e 98 f7 3c a4 b8 8a Data Ascii: gkR=/DbHMD0",.{<Lt"gK!HuHZp&"QKfI 0[A-J8flMs~DFkZv\|!&taY)kfQYYLX_e2,O.zZD-G;qWI\/MaU\qT.<
2024-12-12 10:17:24 UTC	16384	IN	Data Raw: 1e d4 2c 32 64 de 1b e9 db 7d 89 6f e8 0c f9 b7 4a ea f1 e9 85 8a 6d 3c e4 3a d7 a7 2b a3 d5 e7 64 ab 34 1f ce 71 ee 2a ad 19 4e f9 7a ab 56 c7 5c fc b7 35 28 28 8d 60 98 2b e7 45 ed f4 82 54 b1 55 f4 43 6a d9 e1 34 a5 ab d5 58 9d 8a e1 3d 3b aa 87 31 39 ef 24 9e 73 50 9a e3 5c aa b1 d4 8e 84 d3 d4 c2 5f 4f 3a 01 b0 89 4a 16 53 87 16 0f ee c2 5e 7c 4c d3 8c 1d 74 a3 6d c2 d7 46 2b 87 33 cf 64 b8 7a 9d 8b c6 32 dc 48 a7 b4 05 18 85 fa 88 6a 20 72 19 49 a4 0e c2 6c 16 24 fb e5 6e 42 59 8c 7e 67 8e e2 a1 2e be 7e b5 96 f3 58 e8 84 11 8f 29 6c 5f a3 ca ff a9 e1 65 94 62 db 19 28 0b 43 ec 07 62 0e 97 7b 12 78 3a f5 36 3d 63 ea 46 7d 4e 0c 3b f4 20 0d e9 b4 30 b0 fe a5 e9 68 56 d5 26 4f 3c 3a 52 69 33 2f d4 ad 19 35 f3 09 f8 79 b3 a8 fd 40 8b e3 6c 6b 6c c4 2c Data Ascii: ,2d}oJm<:+d4q*NzV\5((`+ETUCj4X=;19$sP\_O:JS^\|LtmF+3dz2Hj rIl$nBY~g.~X)l_eb(Cb{x:6=cF}N; 0hV&O<:Ri3/5y@lkl,
2024-12-12 10:17:24 UTC	16384	IN	Data Raw: 33 8a fd b5 e7 da a8 ff 0c 99 e1 fd e3 4c 99 56 34 24 1c dc a5 32 e8 18 e4 af 55 96 54 7b ac 48 2d 3a 00 84 9d 32 16 00 22 23 14 d3 e5 22 cb 20 63 b1 4d c8 07 72 30 88 5b 59 b6 a5 a0 cf 36 17 33 40 3d 4f da af 22 4e fe 98 ca ed b4 e6 ca f8 3d 42 ee e1 1f c8 7f 58 65 a4 5d 24 e9 d4 06 30 87 24 e1 83 67 2e 38 88 cc c0 07 7e 49 ea 82 8c 03 c5 f1 11 d8 5a d8 8b 2e 6d 28 f3 e2 b0 3b 72 53 e2 c8 16 b6 a0 63 6c 6c 85 ed 99 ab e4 d6 33 0a 16 29 4f bd 54 ed 7a b6 cf 88 b6 9d 06 93 44 e9 e5 eb 8e 42 ad 28 b1 df 6d 3c 37 df ed 90 f8 0b 70 36 87 44 07 f6 0d 9d 20 fb e5 61 60 1b 20 2f 3e ab 2c 80 1e f2 5f 44 e3 fb aa a6 75 b3 ad 6c 11 e4 a5 e8 45 58 4b 97 21 0d cf 45 9e 23 27 fc 49 d9 07 17 89 71 0c c9 09 46 14 d7 32 8f 92 c2 65 e8 a7 16 44 1e 51 25 37 9f 7a 99 8c 96 Data Ascii: 3LV4$2UT{H-:2"#" cMr0[Y63@=O"N=BXe]$0$g.8~IZ.m(;rScll3)OTzDB(m<7p6D a` />,_DulEXK!E#'IqF2eDQ%7z
2024-12-12 10:17:24 UTC	16384	IN	Data Raw: fa 1c 24 3b 26 92 7f 2d 47 47 96 48 e0 60 9e 13 23 31 79 61 b7 2b 18 e5 12 2e 1e 4e a2 93 2b 60 63 5d b3 f7 59 02 6a 2d 5b 4a 03 db cc b5 ed 79 a9 cc 3b 17 65 a1 aa d3 67 13 78 07 af c8 7e 66 a5 09 65 04 c3 d3 65 3e 73 be ea 58 7a 17 97 8e e0 cf a3 03 48 94 b3 46 a5 75 25 ce c4 20 8f 3c 2b 72 bf ec 0f f2 b0 b2 2f 07 e9 3f 77 b4 40 54 fc 9f 8a 7c 82 06 d1 73 e1 41 32 eb 76 1d 61 ae ff 67 be 45 e0 58 23 86 b9 d9 df 19 d8 9f 95 f8 ab 8a 4c de c0 35 40 f4 b5 b2 2c f3 2d 5d 8a 97 91 9b 1a e5 a0 3b e3 68 8b aa b5 3e 22 91 86 d3 15 d0 8f 7b 75 3d e6 2f 05 1e 64 91 e1 2f 96 8a 4b 3d af 07 f9 a4 a3 84 31 52 bc 56 ef d3 80 f5 f5 60 b2 b3 b6 ef 2c 01 aa 6a 5f 9c 26 c5 00 50 e3 da 5c 9c 38 17 83 42 1d ae 7f c3 4a 06 db f0 82 0a fe 04 5b 52 fd c1 ba 39 9c 50 e3 1d 96 Data Ascii: $;&-GGH`#1ya+.N+`c]Yj-[Jy;egx~fee>sXzHFu% <+r/?w@T\|sA2vagEX#L5@,-];h>"{u=/d/K=1RV`,j_&P\8BJ[R9P
2024-12-12 10:17:24 UTC	16384	IN	Data Raw: 83 76 76 f6 33 15 34 fb d7 c7 8d 0a 3c 6d 2e 88 e9 60 90 a7 dd 18 3a 4d 4a 5a 2e 1d 55 8d cf a0 8c 1a 31 d8 53 99 f7 d3 73 64 12 a6 40 15 bf 3a 61 5a d2 0d 88 a5 4c 94 21 a1 d3 42 16 88 63 b5 6f 6e d7 69 89 19 92 05 48 12 75 1a b0 15 bb 74 17 02 fb e1 ed 9a 44 ef 15 56 08 2f 9d 33 00 19 de e9 45 e0 35 30 0a b0 97 b9 1f c3 98 92 b1 75 3e 5e 88 40 eb b0 4e 32 b1 0a a1 5d fb 7b b0 38 1f 13 2e 95 00 29 e4 77 b6 61 98 27 2d f5 4d d0 67 f5 38 1e 41 a9 75 36 2e 7b 51 e3 e0 8a f3 72 3e 10 69 47 98 19 5c 56 68 7e a8 18 11 64 06 ab 20 ff ff 9e 1a 86 e0 9e 01 67 08 ac 2e 2a 0a 5b 7e 3e a5 8a 44 62 0a c8 c2 75 bb 30 44 74 9b a2 7a 6c 7e e9 f1 18 ce e6 af 9a 46 6b ad 51 d8 68 d9 ba 4d 73 84 e9 bc 9d f1 1b c3 ae e1 e6 1d bd cf 37 29 58 de 58 96 1c d1 3f 53 7b c9 58 98 Data Ascii: vv34<m.`:MJZ.U1Ssd@:aZL!BconiHutDV/3E50u>^@N2]{8.)wa'-Mg8Au6.{Qr>iG\Vh~d g.*[~>Dbu0Dtzl~FkQhMs7)XX?S{X

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	50056	52.222.144.9	443

Timestamp	Bytes transferred	Direction	Data
2024-12-12 10:17:26 UTC	184	OUT	GET /agentpackagesnet45/AgentPackageInternalPoller/23.8/AgentPackageInternalPoller.zip?JAAaEzzHK/MPzr14ly9+jBMRTQ5eWjJcXFjIFMEbZ/t0iXVPbmE0NEY4jlleB+S+ HTTP/1.1 Host: ps.atera.com
2024-12-12 10:17:26 UTC	671	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 833993 Connection: close Content-MD5: mx+XpBv7lfFIhotJRg2dBA== Last-Modified: Mon, 18 Mar 2024 07:10:03 GMT Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 92e04611-a01e-0029-066f-4b43be000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Thu, 12 Dec 2024 01:55:12 GMT ETag: 0x8DC471A6ED8B4D3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a31f1272d73a641463b7203596a00056.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MRS52-C2 X-Amz-Cf-Id: 7dK5d8SHCXe1LTnjVterGgDU5Il7UaPPCLgttfgvhZdUBggPZn89tw== Age: 30152
2024-12-12 10:17:26 UTC	15713	IN	Data Raw: 50 4b 03 04 2d 00 09 08 08 00 3b 39 72 58 db 39 15 b6 ff ff ff ff ff ff ff ff 39 00 14 00 41 67 65 6e 74 50 61 63 6b 61 67 65 49 6e 74 65 72 6e 61 6c 50 6f 6c 6c 65 72 2f 41 67 65 6e 74 50 61 63 6b 61 67 65 49 6e 74 65 72 6e 61 6c 50 6f 6c 6c 65 72 2e 65 78 65 01 00 10 00 30 5a 03 00 00 00 00 00 c0 55 01 00 00 00 00 00 cd 87 f4 65 65 a2 1e 54 68 38 a3 0d d2 c6 d4 de 85 15 b9 ad af dc 86 aa c7 74 97 76 c2 67 b3 f7 9d a7 67 c1 8e 7f db d0 f5 4d c8 9c 99 f4 e8 10 be 0d c3 d6 bc 63 9f cd 4b b7 60 7c d0 27 31 c2 57 fa 67 d3 3b b8 57 2b d0 65 b0 c1 8e d0 b4 8c 44 14 90 22 7c 16 f9 e7 5d 2d 3a 08 54 6f 90 3a 90 60 42 28 0c 45 7b fb 54 0d 3f 04 96 7a ad 1a fb 26 1e 94 95 05 e2 67 13 d9 02 af d8 31 cc 2c 6b 6d 38 19 b2 14 e7 df 59 9d 81 07 12 a6 0d 57 5a 6d 3b 91 Data Ascii: PK-;9rX99AgentPackageInternalPoller/AgentPackageInternalPoller.exe0ZUeeTh8tvggMcK`\|'1Wg;W+eD"\|]-:To:`B(E{T?z&g1,km8YWZm;
2024-12-12 10:17:26 UTC	16384	IN	Data Raw: 83 63 f2 ae fd cd ca ab 00 f5 fc 81 ef b1 89 94 ae 24 41 98 71 3a 09 dc e0 83 68 99 25 23 d5 4d 29 3f 09 b5 98 aa 86 28 36 0e f9 5b 95 9d 75 96 8c 5f d7 1d fe 84 6b 0a e9 2f c6 e8 8a 8b f0 49 ac 28 1e e3 c4 8a d3 2a 42 a4 5d 41 4a 38 67 f1 99 56 d9 ff eb 67 e4 c6 34 5b c2 f9 51 54 22 77 dc b4 69 bf 3c bc 1f d0 38 d9 38 18 86 c2 70 74 01 62 62 1a a7 86 63 01 5d 24 26 1c 8f 16 f5 56 05 70 76 19 7c 39 43 9b 1a d0 0e de 88 ea 23 b1 fb 13 69 bf 12 17 79 82 67 33 80 20 97 20 47 6b 4b ca a0 e7 6e ee 57 d8 3e 05 7b bb 75 4a da 2d 5c bc b7 c2 c8 da 29 fa 97 c3 a1 98 62 4d e1 c2 13 46 61 12 bc 4d 37 77 08 e1 ad 69 90 f2 67 5b 25 0a 86 2f 6c 5c e9 0e 67 3f 49 02 de b1 9a b5 ec 26 b0 08 ca bb 83 f6 61 0f 06 1f e9 fb a4 11 8a bd 74 ec c9 8f 32 82 9c 53 ae 54 a6 33 ea Data Ascii: c$Aq:h%#M)?(6[u_k/I(*B]AJ8gVg4[QT"wi<88ptbbc]$&Vpv\|9C#iyg3 GkKnW>{uJ-\)bMFaM7wig[%/l\g?I&at2ST3
2024-12-12 10:17:26 UTC	16384	IN	Data Raw: 08 25 30 24 fd e5 27 4b eb 6d 85 35 05 77 97 87 0e 97 23 44 74 cd 49 eb 4a 79 0c 77 4a b0 b5 ce 0a 5f eb 81 fb b6 20 25 61 83 d0 4d e0 3e 3b 75 bc ec 50 71 83 67 fc 38 f6 37 15 f4 7e 30 31 d3 a5 bb d7 71 fb 0e 7a 73 20 cd 26 a5 76 f0 bc 1b cd fd 0c 44 fb 23 de 87 cf 07 23 f5 10 90 cb 71 c4 7f f5 76 00 c0 6f f4 16 81 cf d1 b5 37 12 9c 98 ce c5 5e c1 27 90 af 96 1e 3b 17 01 23 ee ac 1a f4 bf 9b 79 da 6b 2f e2 23 32 e7 f0 50 c9 f8 41 bb 99 ae 08 39 8d 57 45 14 dd be 92 9d 79 fb 33 21 ce 47 ad 65 7e 97 6c c3 dd 51 4a da 1d 15 08 f5 1f 59 54 0d 04 c7 c8 e3 ee e8 25 99 06 df 99 4d 5c 05 e0 92 e0 bc 9d 27 8d 89 d7 e6 3d 9a 8f 59 d9 ff 66 57 1d 7e 2d a4 26 cd 0b 06 47 25 b1 fd c4 f8 fc c6 1d 06 9f eb 8a bd 67 df 49 8d 9a 4d 82 e0 48 4f f0 c9 7b 5b 45 cc 31 e4 fc Data Ascii: %0$'Km5w#DtIJywJ_ %aM>;uPqg87~01qzs &vD##qvo7^';#yk/#2PA9WEy3!Ge~lQJYT%M\'=YfW~-&G%gIMHO{[E1
2024-12-12 10:17:27 UTC	16384	IN	Data Raw: 34 fd e4 28 42 3e b0 c4 bf 7e 11 1c 5a dd 07 54 96 ca af 48 38 de 25 d1 70 d6 6d 5f 68 88 d8 9a 75 e4 1e e1 19 60 7c ee 54 9d 3a a3 d7 2c dd aa e5 bf da 64 d2 b2 57 ee 97 8f bf d6 39 c4 43 2e f7 ad 36 3b 95 e6 fb 34 31 01 60 4a c4 3f 37 53 23 81 11 03 d1 61 c1 49 6d e3 4d 8e 2c 23 19 35 44 45 5a 15 8e 69 33 cc 63 f0 e2 7d d9 83 89 d5 e7 f1 99 a1 a1 10 11 71 b3 79 f9 60 4c de 08 0b 97 17 73 a1 36 29 3a c2 99 2b cd ef 26 c6 9b 79 dd 88 1d 41 47 42 1e 0d 9e be 11 61 f5 c8 69 9e f5 59 10 37 27 09 40 b5 d4 b0 6a 9f 75 55 ff c4 f0 c2 c0 f6 58 f3 be c7 56 5a 3f 7e 1e 9e df f6 d2 19 4c 4b 30 3b dc e0 ad aa 49 b6 f1 3d 10 51 77 73 28 a9 88 2b 56 56 e7 9b dc 77 97 fd 6b ca 96 3e 27 cb ff 72 83 a1 82 0d c0 0b 79 35 08 5d 6a d6 b1 ce 8e e2 53 d2 af d0 75 56 38 41 fa Data Ascii: 4(B>~ZTH8%pm_hu`\|T:,dW9C.6;41`J?7S#aImM,#5DEZi3c}qy`Ls6):+&yAGBaiY7'@juUXVZ?~LK0;I=Qws(+VVwk>'ry5]jSuV8A
2024-12-12 10:17:27 UTC	16384	IN	Data Raw: a6 c4 70 19 8a f0 37 69 52 d8 dc 4b 12 67 70 3e 91 49 7e 33 40 c6 23 8d fd 1d 4d b4 3f cd ff 36 3f 57 9d c8 d5 f1 57 71 09 d0 26 e1 21 1d f1 ff 0f 56 14 61 76 2b 3f 95 75 b2 a9 82 c7 17 3b 89 5e 58 6b 72 56 19 21 94 47 42 8a f1 1b d5 49 7b 3d 3c 10 04 02 cb c7 92 36 74 7f 20 9e d2 39 61 f3 bc 46 9d 28 e8 f5 f2 25 22 cc 03 47 5c 6e 1a e6 49 f1 bf 30 ec 03 02 a4 87 85 9e f7 c5 cc 2e 39 db 86 0b 53 d3 9e 95 bb a3 a2 43 3b d0 9f 6f 63 b3 a6 45 f4 c1 e2 9d 5d 0a 67 fb 47 1c 59 af 15 dc 44 83 04 82 15 26 50 dc f2 a1 c4 b5 2f 6a 06 66 5d 4f 16 a4 93 fa 5b e8 b1 6a e3 26 74 0d cf 0b a3 3a 1e f7 cb 61 c2 da 8c fe 91 61 8d ae 9c 51 ab 97 0a fb 9b ce bd e3 f8 aa c5 71 b1 18 17 e5 58 91 94 9d 5d 21 54 83 fc e6 66 f6 d4 e5 18 27 bf 8a e0 c7 90 54 d9 6b 9b ac fc 23 2a Data Ascii: p7iRKgp>I~3@#M?6?WWq&!Vav+?u;^XkrV!GBI{=<6t 9aF(%"G\nI0.9SC;ocE]gGYD&P/jf]O[j&t:aaQqX]!Tf'Tk#*
2024-12-12 10:17:27 UTC	16384	IN	Data Raw: 5f d6 05 b9 b8 d3 b6 7d c1 d3 80 e2 7b 72 0c b6 b3 09 01 4c 14 5b da 8e ed c5 ef 61 35 17 5d a4 74 4c f6 f8 5a 57 3c 14 6b bd da 9c 59 99 1d 83 5c 3f 08 d2 c5 73 ee fa c2 a4 0d 61 35 03 8b a0 6e e2 5f 37 61 3e 8a da 1c 0e e9 2d ae 3e 3d 35 bf d9 cb fd 6a 7d 90 23 38 13 f7 6e 35 88 9f cd 74 72 d4 20 32 67 fe d0 27 ce ae 48 4e 16 83 d1 ff 67 7c ef bf ae 8c 50 1c 47 d6 a9 0b 39 71 46 a6 17 f7 41 34 79 af ea 16 ad f7 a6 e4 b1 12 90 80 29 e7 b8 15 52 93 5b 46 2d cb e7 75 91 e7 cb 15 87 83 ee bd f0 a4 04 5c df d2 44 b2 25 e5 68 f2 23 4e f1 0a 5c 31 81 d8 23 68 77 53 b8 9d 1d 6b 13 7b 12 de 69 0a 1b be ee 44 ef f6 65 3b c5 85 85 db 61 a7 ad eb 98 9d 0c fc 74 9f c1 ec fa 4e b9 0b eb 63 70 b0 4e 69 48 a1 3d 77 4a 19 d4 19 65 d9 45 7b 0a cc c7 8f c6 bd 22 c7 35 33 Data Ascii: _}{rL[a5]tLZW<kY\?sa5n_7a>->=5j}#8n5tr 2g'HNg\|PG9qFA4y)R[F-u\D%h#N\1#hwSk{iDe;atNcpNiH=wJeE{"53
2024-12-12 10:17:27 UTC	16384	IN	Data Raw: 8d 0f 15 e9 4e 8c 9f 78 39 ff 42 a6 df 8b 2e 74 17 53 0c b7 a6 51 dc 3e 20 f1 2d f3 41 9e 54 b9 be a8 6a 00 7f b7 65 b6 2d e9 7e 4f 02 f5 3f fe 3b 19 34 0f cb 22 b8 67 71 e7 5c 32 51 d5 dc 62 b5 9f 9a 46 9c 9e 7b 22 a4 3e 17 b8 73 02 3c 40 3f c6 69 05 9f 91 43 11 83 db d7 f4 bd e8 c8 7b 80 da 8d 5b d5 0e 03 73 77 79 a1 a3 8e 38 54 63 59 5b 09 98 71 9d d3 e4 16 fc 4c 75 b4 bc 6b a1 74 da 88 10 14 7e 64 a4 3c 0f bc 50 ff c5 8f d9 f9 47 eb 8f c2 55 a6 d3 19 9a 8c 84 25 34 4d 02 9f ea 50 6f dd 67 18 e1 fd 5c 96 38 55 18 b8 5d 3c 64 78 97 42 ac 34 05 30 68 5c 3f 56 c9 9d 0d f2 39 92 b6 ba b6 4f 7a fc 0a e2 f8 ee 16 a4 cb 2b 40 d3 98 fa ba 5b fe 4f 63 eb e2 06 0a ff 32 16 ca dd c5 67 1e 96 2c dc 93 e6 27 d5 30 60 9b 69 5f 7e d7 6d 51 2f c8 ee 83 b9 49 21 71 15 Data Ascii: Nx9B.tSQ> -ATje-~O?;4"gq\2QbF{">s<@?iC{[swy8TcY[qLukt~d<PGU%4MPog\8U]<dxB40h\?V9Oz+@[Oc2g,'0`i_~mQ/I!q
2024-12-12 10:17:27 UTC	16384	IN	Data Raw: fc 7c 27 2f 47 7b ee 7d 5b a7 17 10 c9 4b f5 25 cc 5a a4 1f ed 5a ba 61 1c b2 b8 8c f4 72 81 72 47 12 3c 73 8a 07 f3 ec 40 f9 d2 ff 63 e2 cf f8 05 2d 41 6c 7d 94 93 f7 d1 df 36 97 43 64 17 49 11 e7 1e f1 b0 92 af cf b7 e5 73 d6 32 31 9f 7d 84 ba 8c 84 66 39 e4 63 88 0a 53 bd ae 3f 0c b1 e9 df be 8b 32 27 6a 0d c3 4e fb b3 ac aa fd b2 aa 13 41 a0 bd 8e 5e 29 a8 e0 72 c5 5e 9d ec ed 83 6d 09 53 d1 b1 02 2f cb 7c be 65 34 7c dd b5 89 20 ce 4d c8 63 3f 8b a6 eb b5 7c e9 1e 40 3e 89 7a ad ba a6 95 1b 2a 9c 06 6a 7a 56 13 56 eb e9 2d eb c4 0f a8 2c 6e ed 68 fa 8d e7 c3 4e 43 0d 59 e8 98 83 56 59 a6 66 83 db 5e fa 09 38 45 f9 5e 22 6a 96 15 e7 42 99 f2 23 cf ba 90 ce f6 40 c7 36 9a 6d 7f b9 1a 06 32 c2 99 47 e5 8a ad c7 01 97 f7 6d 0d 5c a0 b6 92 90 d5 7c f8 12 Data Ascii: \|'/G{}[K%ZZarrG<s@c-Al}6CdIs21}f9cS?2'jNA^)r^mS/\|e4\| Mc?\|@>z*jzVV-,nhNCYVYf^8E^"jB#@6m2Gm\\|
2024-12-12 10:17:27 UTC	16384	IN	Data Raw: e9 b4 af 23 3a d1 f3 8c 74 0f 01 15 b1 1d 6d ba e2 bc e4 e8 b0 57 ae 94 ec 56 2b f7 db 60 cf 8e 26 c8 e6 3e 2e 56 4c 26 b6 b1 a1 5d 6b be cb e2 19 75 18 e1 00 c4 b4 2d f1 2b bc 73 cd 39 83 a2 76 72 de 27 ac 53 16 49 1f f5 0d 88 d9 f9 04 e7 57 8f 33 30 81 bf 3e 5d cf d6 76 bf b1 2c ad 07 cc 58 aa c4 c5 41 33 b5 68 42 a3 49 9b d0 c8 12 f5 a4 79 85 ba 21 fe 7e 52 32 a0 6a ec 4f 7b 86 79 bc b5 6b f7 a9 7e fb 37 87 23 38 60 db 04 f7 b2 c5 20 c3 a9 fc f7 29 fc 78 bc d1 c1 12 d7 8c b9 49 e4 38 f1 ad 24 f8 f0 6b e1 0d b6 81 35 10 6f 7f 6d 6d 67 ca f9 ff cc 7d 46 cb 6a bf 13 64 f4 dc 5b 14 23 f1 3c cd 9f 70 90 7b 96 8e 3a 15 f5 83 c7 4b c9 9a 1b 5d 56 f9 ff a5 77 8a ad c6 d6 a3 6f 7c fe 6a 26 b1 d3 a5 a4 17 54 58 24 ba f8 94 2a b0 cd 1c 59 ee db 1e 5b 1d 8a b9 a7 Data Ascii: #:tmWV+`&>.VL&]ku-+s9vr'SIW30>]v,XA3hBIy!~R2jO{yk~7#8` )xI8$k5ommg}Fjd[#<p{:K]Vwo\|j&TX$*Y[
2024-12-12 10:17:27 UTC	16384	IN	Data Raw: ed 7a 62 7b f3 0c bd 2f 8a c9 92 9c a7 45 11 76 88 18 82 85 9c 11 5f f6 7f d3 33 48 0d b9 82 e3 f2 34 a6 b2 f1 15 5c 67 1b ce 22 4b 83 89 fb c4 9c ec bd 6c e9 95 5c 85 d8 95 ad 4d 7d ed 9a 97 50 68 49 27 61 e8 78 7b c1 2a ea 58 1a 44 ae 97 db 4c 80 e9 98 0d fe 14 31 b4 0a d2 2a 7d 2c 9a 1b c3 2c e6 dd d5 3c 75 87 79 76 3f 6d 7f aa 7d 2f 51 5e a6 e6 1c 03 0e 26 9d 6a cb 3d eb b6 d6 3f 84 72 ea 06 3c 5d 89 0d 34 06 25 30 4e ac 4b 7a 2b 7d ff 3b 9f fa 3d 36 0a 69 36 a0 04 36 4f e5 2a 03 7a 89 08 f5 db 9c d4 bc 5a f5 92 6c 01 2c f5 76 92 83 f9 2f 2c df 14 f8 36 f9 47 d9 3b de fa b4 ab 23 f1 56 71 2e 7b ab 9d c7 0c b5 1f d3 82 59 94 e7 4f b8 b2 8a db 86 62 51 51 88 2f 03 96 81 36 14 0f 8a b0 60 83 e1 30 c0 5a 20 fa 5c f9 8c ad bb a9 62 40 4a cd a4 a5 73 3e 85 Data Ascii: zb{/Ev_3H4\g"Kl\M}PhI'ax{XDL1},,<uyv?m}/Q^&j=?r<]4%0NKz+};=6i66O*zZl,v/,6G;#Vq.{YObQQ/6`0Z \b@Js>

Target ID:	0
Start time:	05:14:57
Start date:	12/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\RQ--029.msi"
Imagebase:	0x7ff6ac190000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:14:58
Start date:	12/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6ac190000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:14:59
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 3B85228B7D1C8929A727F0F59CB02AA3
Imagebase:	0x400000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:14:59
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Windows\Installer\MSI25B4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5449250 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
Imagebase:	0xf20000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000003.00000003.1680538318.0000000004C12000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:15:00
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Windows\Installer\MSI2CD9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5451000 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
Imagebase:	0xf20000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000004.00000002.1749347665.00000000044E4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000004.00000002.1749347665.0000000004441000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000004.00000003.1694532699.0000000004355000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:15:06
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Windows\Installer\MSI438F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5456796 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
Imagebase:	0xf20000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000005.00000003.1752210108.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:15:07
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding CACFC9F983F5284DFDC6FC6746D31D7F E Global\MSI0000
Imagebase:	0x400000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:15:07
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	"NET" STOP AteraAgent
Imagebase:	0x460000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:15:07
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:15:07
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 STOP AteraAgent
Imagebase:	0xcd0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:15:07
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"TaskKill.exe" /f /im AteraAgent.exe
Imagebase:	0x230000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:15:07
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:15:08
Start date:	12/12/2024
Path:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="contato@opticaperformance.com.br" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000OJqMsIAL" /AgentId="14216fa6-dc15-4519-acf9-f0e1b34954b6"
Imagebase:	0x1df810f0000
File size:	145'968 bytes
MD5 hash:	477293F80461713D51A98A24023D45E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821854743.000001DF82FB2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821854743.000001DF8307C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1823822816.000001DF9B78E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000000.1766473024.000001DF810F2000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1826138736.00007FFD9B414000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821854743.000001DF82FBA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821854743.000001DF83066000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821854743.000001DF82F89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821854743.000001DF82FB4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821854743.000001DF83032000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1820419607.000001DF8119C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821854743.000001DF82F8C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1820498326.000001DF811BC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821854743.000001DF82FC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1825116949.000001DF9B8CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1820498326.000001DF811B4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821854743.000001DF83035000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1820498326.000001DF811D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821201322.000001DF81530000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1820498326.000001DF811D3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1820419607.000001DF81190000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1825116949.000001DF9B905000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1820498326.000001DF811F3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1820498326.000001DF81221000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821854743.000001DF82F01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000C.00000002.1821284162.000001DF81550000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe, Author: Joe Security
Antivirus matches:	Detection: 26%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:15:13
Start date:	12/12/2024
Path:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
Imagebase:	0x15e3b110000
File size:	145'968 bytes
MD5 hash:	477293F80461713D51A98A24023D45E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2933946577.0000015E3BE3D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2933946577.0000015E3BC5E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2926789320.0000015E3B22C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2925832359.0000015E3B1C0000.00000004.00000020.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2911502671.00000039F5375000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2964905053.0000015E54720000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2933946577.0000015E3BDC4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2958992188.0000015E54373000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2966506202.0000015E547DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2933946577.0000015E3BE41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2933946577.0000015E3C417000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2933946577.0000015E3C3EB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2933946577.0000015E3BCF8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2958992188.0000015E542F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2962842731.0000015E54680000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2926789320.0000015E3B274000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2933946577.0000015E3BBF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2926789320.0000015E3B1F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2933946577.0000015E3BE92000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2933946577.0000015E3BDD3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000000D.00000002.2931929153.0000015E3B540000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	05:15:13
Start date:	12/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
Imagebase:	0x7ff7f37c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:15:13
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:15:14
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Windows\Installer\MSI619B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5464500 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
Imagebase:	0xf20000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000011.00000002.1883270062.0000000004954000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000011.00000002.1883270062.00000000048B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000011.00000003.1832739363.0000000004484000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:16:27
Start date:	12/12/2024
Path:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dfd08f75-8b51-48fd-ab32-5327cfebcacf" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000OJqMsIAL
Imagebase:	0x262141b0000
File size:	178'728 bytes
MD5 hash:	83FD950ED584099A4125EFBA77E26BAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000015.00000002.2608580404.000002621447C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000015.00000002.2608580404.0000026214380000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000015.00000002.2609356829.0000026214B31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000015.00000002.2609078888.00000262145B0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000015.00000002.2610343948.000002622D40B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000015.00000002.2608580404.000002621440C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000015.00000002.2609275400.0000026214AE2000.00000002.00000001.01000000.00000018.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000015.00000002.2608580404.00000262143C0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000015.00000000.2560902012.00000262141B2000.00000002.00000001.01000000.00000016.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000015.00000002.2609356829.0000026214BB3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000015.00000002.2609356829.0000026214BA3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:16:27
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:16:34
Start date:	12/12/2024
Path:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "0b83ff3f-4e98-4112-9bc1-991064e5f975" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000OJqMsIAL
Imagebase:	0x1dde41b0000
File size:	178'728 bytes
MD5 hash:	83FD950ED584099A4125EFBA77E26BAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2828323869.000001DDE4DB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2827219433.000001DDE438A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2828323869.000001DDE4DDF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2837681843.000001DDFD673000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2835065748.000001DDFD432000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2836087609.000001DDFD58C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2828323869.000001DDE4DE3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2827219433.000001DDE435B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2828323869.000001DDE4E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2835842751.000001DDFD4DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2828323869.000001DDE4C05000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2828323869.000001DDE4D1D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2827025394.000001DDE42D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2828323869.000001DDE4B71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2833724925.000001DDFD399000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000017.00000002.2827219433.000001DDE4320000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:16:34
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:16:34
Start date:	12/12/2024
Path:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "dd995738-a43a-417d-bb93-8167d39082a0" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000OJqMsIAL
Imagebase:	0x221ac280000
File size:	178'728 bytes
MD5 hash:	83FD950ED584099A4125EFBA77E26BAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000019.00000002.2637732373.00000221AC452000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000019.00000002.2638542145.00000221ACC23000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000019.00000002.2637732373.00000221AC3D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000019.00000002.2637732373.00000221AC3D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000019.00000002.2638542145.00000221ACC33000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000019.00000002.2637732373.00000221AC40B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000019.00000002.2638542145.00000221ACBB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000019.00000002.2637651947.00000221AC390000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:16:34
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:16:34
Start date:	12/12/2024
Path:	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
Imagebase:	0x1b2c6690000
File size:	145'968 bytes
MD5 hash:	477293F80461713D51A98A24023D45E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2910170206.0000001534165000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2921232065.000001B2C69A6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2926775706.000001B2C6FD8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2926775706.000001B2C7285000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2954879800.000001B2DFC7D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2926775706.000001B2C7219000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2921232065.000001B2C6920000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2954879800.000001B2DFC20000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2921232065.000001B2C69DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2926775706.000001B2C6F41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2926775706.000001B2C6FC4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2921232065.000001B2C6928000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2921232065.000001B2C6959000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2926775706.000001B2C6FCC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2924503092.000001B2C6BB0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2926775706.000001B2C70E2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2954879800.000001B2DFCA7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2926775706.000001B2C7095000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2926775706.000001B2C7122000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2926775706.000001B2C725F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2921232065.000001B2C695C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2926775706.000001B2C6FE2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001B.00000002.2926775706.000001B2C71C4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	05:16:35
Start date:	12/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
Imagebase:	0x7ff7f37c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:16:35
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:16:35
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus
Imagebase:	0x7ff72de90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001E.00000002.2703342225.0000021125FFC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001E.00000002.2703342225.0000021125FF0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001E.00000003.2638815527.0000021126220000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001E.00000002.2703342225.0000021126013000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 0000001E.00000002.2703495802.0000021126200000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:16:35
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:16:35
Start date:	12/12/2024
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus
Imagebase:	0x7ff70d6e0000
File size:	161'280 bytes
MD5 hash:	24590BF74BBBBFD7D7AC070F4E3C44FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000020.00000002.2701906266.0000023E082F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	05:16:36
Start date:	12/12/2024
Path:	C:\Windows\System32\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sppsvc.exe
Imagebase:	0x7ff7806d0000
File size:	4'630'384 bytes
MD5 hash:	320823F03672CEB82CC3A169989ABD12
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	05:16:38
Start date:	12/12/2024
Path:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "6141f59d-aac4-4ed0-a2a6-5cc28d11fb39" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOm51bGwsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 001Q300000OJqMsIAL
Imagebase:	0x2bddbed0000
File size:	72'744 bytes
MD5 hash:	67FEF41237025021CD4F792E8C24E95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000000.2669697402.000002BDDBED2000.00000002.00000001.01000000.0000001A.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000002.2923031816.000002BDDC240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000002.2940815641.000002BDF5147000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000002.2918270056.000002BDDC0A1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000002.2918270056.000002BDDC06C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000002.2918270056.000002BDDC060000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000002.2927182354.000002BDDCACB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000002.2927182354.000002BDDCB61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000002.2927182354.000002BDDCB53000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000002.2918270056.000002BDDC0AB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000002.2918270056.000002BDDC0ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000002.2911496485.000000C5B43E1000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000022.00000002.2927182354.000002BDDCA51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	05:16:38
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	05:16:42
Start date:	12/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k smphost
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	05:17:00
Start date:	12/12/2024
Path:	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 14216fa6-dc15-4519-acf9-f0e1b34954b6 "be3e4666-7f93-4f4c-b51b-88298548f7af" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000OJqMsIAL
Imagebase:	0x1a406980000
File size:	398'384 bytes
MD5 hash:	5E3252E0248B484E76FCDBF8B42A645D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2956305413.000001A41FB7F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2920984998.000001A406B70000.00000004.00000020.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2922460675.000001A406E32000.00000002.00000001.01000000.0000001D.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2956305413.000001A41FBB9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2964825175.000001A420C08000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2924474756.000001A4073A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2918487841.000001A406A7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2918487841.000001A406B01000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2956305413.000001A41FB50000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2918487841.000001A406A70000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2921596858.000001A406D10000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000000.2885237430.000001A406982000.00000002.00000001.01000000.0000001B.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2918487841.000001A406AB4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2984638251.00007FFDF1329000.00000004.00000001.01000000.0000001C.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2964703030.000001A4209F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2910123007.00000014F27F0000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: 00000025.00000002.2924474756.000001A40748E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AteraAgent, Description: Yara detected AteraAgent, Source: C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	05:17:00
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 04E01630 Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

$^q, xrefs: 04E016DA
$^q, xrefs: 04E016CE

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: b659f3e158f15c474f646f35e317010b71a619d57a0374a2754232296a0905f5
Instruction ID: 90d3a74aa8aa5971ee49c6cdec558f63317db900b9d37e86e99446051ea88214
Opcode Fuzzy Hash: b659f3e158f15c474f646f35e317010b71a619d57a0374a2754232296a0905f5
Instruction Fuzzy Hash: 5A51F231B002099FC715DF79D8506AEBBF6BFC9354B18842AE824DB3A4DE319D82C791

Function 04E01080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

(bq, xrefs: 04E011A8

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 25e4580b1c5d3addb57d75f7dc049990f1b6c675a2aceca3306192f89926efed
Instruction ID: 17b624ab04bfb25fc173708bdfaef0b89b1bc80c805db73eaeb4102bc6f51325
Opcode Fuzzy Hash: 25e4580b1c5d3addb57d75f7dc049990f1b6c675a2aceca3306192f89926efed
Instruction Fuzzy Hash: 5471B631B00214DFDB04ABB5D8647AEB6E7AFC8314F14C469E516EB3A4DE35EC828791

Function 04E00C1C Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

(bq, xrefs: 04E018BF

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: c1e580e302d36fcdbbce2cd9c93db2ca34c0b9f2f3a33b15c679a4d5a3179088
Instruction ID: 399ab32c29b4640b0ac8c032cdd91c2aaa2d0b54152f29543e9503073b64712d
Opcode Fuzzy Hash: c1e580e302d36fcdbbce2cd9c93db2ca34c0b9f2f3a33b15c679a4d5a3179088
Instruction Fuzzy Hash: CC51F530704204DFEB049B68E4747AEBBB2EF89318F148069D506EB3C5CE396C45CBA1

Function 04E00E8C Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

(bq, xrefs: 04E0202D

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 9d8bec2cebc034f7bc3977216fe05bbe38cde2a2a6a6fe577f1aec8d39812b23
Instruction ID: 305dce9b35fd6f03e9a34523f1cdb8fa7a1df62ddef4a51c9b3a98461dec03e7
Opcode Fuzzy Hash: 9d8bec2cebc034f7bc3977216fe05bbe38cde2a2a6a6fe577f1aec8d39812b23
Instruction Fuzzy Hash: 9041E631B001159BEB18ABA9A46476EA7E7DFC8318F14D07DDA16EB3D0CE35AC4187D1

Function 04E02644 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

(bq, xrefs: 04E02AFC

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: e811401913957d005d4327028102b15b1bd7490fafcb21f75c0a85f9b05096fd
Instruction ID: bf4418a29fbbdae8473c2bddcc2de2214dc3e2f5a46b1144fdf46a61ea1ea75e
Opcode Fuzzy Hash: e811401913957d005d4327028102b15b1bd7490fafcb21f75c0a85f9b05096fd
Instruction Fuzzy Hash: 3B3117207093548BEB296B35A4283AE3BE7DF85258F18C4FACA51C73C2DD24AC414395

Function 04E02764 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8869a803717de7b14c4b0f4b64f0107e54acf64623f5a926ee8f4f2796f3c7e1
Instruction ID: 963be69c3432c67246640bdd7cd513edde07d77751d28869f82f950c9ebb8284
Opcode Fuzzy Hash: 8869a803717de7b14c4b0f4b64f0107e54acf64623f5a926ee8f4f2796f3c7e1
Instruction Fuzzy Hash: 6CF03071808204CFC744EFA9940169ABBF1EF59214B21C6BEC888E6250FF368552CB51

Function 04E023B8 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075aad63e98e65f6974395a0c56492610af6e3e68a333552bed8e86ac3064e7a
Instruction ID: 290c076b2f9b3028fc44bb8c5b66568b50b6d64ded35386c9e10a0286af761fc
Opcode Fuzzy Hash: 075aad63e98e65f6974395a0c56492610af6e3e68a333552bed8e86ac3064e7a
Instruction Fuzzy Hash: 2A51F331B052118FCB10CF68D498A69BBF1FF48318B15D1E9D964DB2A2DB31EC82C791

Function 04E01F08 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad87008a4d8e1b5adbc831033081d3c3f1c673efa3d8eb82d0859ecc0c82b904
Instruction ID: e4e0f196fe1655c5e6bdd3de6a4f12ee7002fefa87c764dc2c9e134f79c2f660
Opcode Fuzzy Hash: ad87008a4d8e1b5adbc831033081d3c3f1c673efa3d8eb82d0859ecc0c82b904
Instruction Fuzzy Hash: 54317932704205EFC7296B65743562ABB67DF81358709D07AEA18CF2D1CE367841C3E1

Function 04E02268 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09f110dbdc792678e504cd27430d7b0c18ab306ab75ed256f40df46cd046c2d
Instruction ID: fefecce69ebf689f2441b82e4ba61d7dd608d99a521d7be56b49cee4886970e9
Opcode Fuzzy Hash: a09f110dbdc792678e504cd27430d7b0c18ab306ab75ed256f40df46cd046c2d
Instruction Fuzzy Hash: D4413A35B001099FCB14DF69D88499EBBF2FF88714B10816AE915EB360DB31EC42CB90

Function 04E01050 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d885b5e1167021773a7d0bc8370c6cee9a584d2968ba7f26e8b527d0486c0e5d
Instruction ID: 79eac8a5fa33e94c993bbc532ab64a6a9fe3f2b8d86c08a728d12c36c591d7a6
Opcode Fuzzy Hash: d885b5e1167021773a7d0bc8370c6cee9a584d2968ba7f26e8b527d0486c0e5d
Instruction Fuzzy Hash: ED212831B00324DBDB049F68D9606EEB7A6EF84348F04803AD946DB395EE35E9468791

Function 04E02258 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a12cddab234b8a337e166bdadf560b854e84a78bc01d9185ec56df7b9ad69c
Instruction ID: c39d3f0a11644f6969b51ad39ad2f5b9737351c3a785d48cc69f52c23a2f47bc
Opcode Fuzzy Hash: 67a12cddab234b8a337e166bdadf560b854e84a78bc01d9185ec56df7b9ad69c
Instruction Fuzzy Hash: 7C21EA75E101189FCB54DF69D4849DDBBF2FF4C714B108169E915AB360DB31A842CB50

Function 04E01378 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7118e36f92bf3be93173a21a1674b57d09dacee77532e69c99be9833a49ff06
Instruction ID: 4fabd4761f77bbe63bcc5062fa6f5667649c805d1d504b4e261c742394b69838
Opcode Fuzzy Hash: b7118e36f92bf3be93173a21a1674b57d09dacee77532e69c99be9833a49ff06
Instruction Fuzzy Hash: D12115B5D042498FDB10DFAAC4816DEFBB0FB48324F10802DD85967250C779694ACFA1

Function 04E01958 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dcc8781edfef082996dcbd2fc575ebcfbb0e60e86a30841b86503b4cecb9b69
Instruction ID: 1addcd83bb1a57ffff8c98f4ce5c7833797154b46f651286cf7aa4675e10b0fa
Opcode Fuzzy Hash: 7dcc8781edfef082996dcbd2fc575ebcfbb0e60e86a30841b86503b4cecb9b69
Instruction Fuzzy Hash: 9E114F35600215EFCB44DFA8E4B46A9BBB6EF8C319F144019E549A7390CF795C46CBD0

Function 04E01380 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b961396fa9d32cfe7c57460ce4997330fcd620f683b9760fe0eaca5245fc26d
Instruction ID: 16f3c2cfaf460f2226b357dc909f67832fb1fb47609d238e53747590cb48d996
Opcode Fuzzy Hash: 2b961396fa9d32cfe7c57460ce4997330fcd620f683b9760fe0eaca5245fc26d
Instruction Fuzzy Hash: 2B11F4B5D042498FDB10DFAAC881AEEFBF4FF48324F10842AD45967250C7756945CFA5

Function 04E01968 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4df84e8f96219a598aaea75fd376872f667c5c1c23c918bc52ac16efd6312a8
Instruction ID: e56ca70fc1f6e7314daa6edc22f243aea7702b720adf61abc9b698c5285cd8fc
Opcode Fuzzy Hash: e4df84e8f96219a598aaea75fd376872f667c5c1c23c918bc52ac16efd6312a8
Instruction Fuzzy Hash: 65110035604115EFCB44DF69E474AA9BBB6EF8C315F144019E409A7390CF7A5C45CBD0

Function 04E01440 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73efa0873c2d162cac9f77515a56f3dc649f2bf17ecf7d3675aa40f7a819d2f1
Instruction ID: 6b133cf4a31f0a9e80fa8c1e60c02f3d80792bc708a9f32d056b79115f3b8d3a
Opcode Fuzzy Hash: 73efa0873c2d162cac9f77515a56f3dc649f2bf17ecf7d3675aa40f7a819d2f1
Instruction Fuzzy Hash: E001F770B093059FCB099F3479791167FEAEF8170870518AAC54ACF2A1FD2AD84683D2

Function 04B5D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1688739984.0000000004B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b5d000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16651a1673c4d061c41a666e59548da0064c5eb227f0ed0626e55e3edb72e9ca
Instruction ID: 429f8813095f8e6272e02053033883ea5047ef28fa0c7938743d1fb8dca3ce14
Opcode Fuzzy Hash: 16651a1673c4d061c41a666e59548da0064c5eb227f0ed0626e55e3edb72e9ca
Instruction Fuzzy Hash: E8012B705083009AE7104E35DD84767FF9CEF41324F0CC6AAEC084B296D279E846C6B1

Function 04E01829 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a26b270302206d00ca420e0443ef3aae9567d29e1381919b14dbfeac09647721
Instruction ID: 8a2d8c99ea9d4e19ac1baa355ce858bc8db9ed4127073ee58bb70c05eedff8ca
Opcode Fuzzy Hash: a26b270302206d00ca420e0443ef3aae9567d29e1381919b14dbfeac09647721
Instruction Fuzzy Hash: A501F931B0011587EB28AB6891A03EFB7B797C8318F21812DC915B73C4CE7A2D4797E1

Function 04B5D005 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1688739984.0000000004B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4b5d000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5eb5d0341e46c5c617c3a22f0f44ec3da0cf4a706fd34b1bb3e955d0cbaeaa
Instruction ID: 923b98e5a199eaa27f48970d38efa754df83a58c8ffcf361aa9462bf4c5dcba9
Opcode Fuzzy Hash: 1e5eb5d0341e46c5c617c3a22f0f44ec3da0cf4a706fd34b1bb3e955d0cbaeaa
Instruction Fuzzy Hash: BC012D6150E3C05ED7128B2599A4B52BFA8EF42224F1CC1DBD9888F1A3C2699849C762

Function 04E02A98 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded8000a19ac43f60ddbadd35a2c67af03b1fc2ee80267fb96f62f994092a2db
Instruction ID: 7a45f0d2ea4ae4a04294c33af78d882bdec653e977ded0ba3d98aa21e3a1e707
Opcode Fuzzy Hash: ded8000a19ac43f60ddbadd35a2c67af03b1fc2ee80267fb96f62f994092a2db
Instruction Fuzzy Hash: F2F02B357053008BC7385F1AE09467977E7AF88328B04D0BADB94872D1DF246C819290

Function 04E02664 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa5024cb022c832d8beca8fc44def083b098861a61bd4edb5a09abb48748945
Instruction ID: be881a4a0d70c696ff50a775b37f685bfe6f95c5948b1dce9b6b1224a86e682c
Opcode Fuzzy Hash: aaa5024cb022c832d8beca8fc44def083b098861a61bd4edb5a09abb48748945
Instruction Fuzzy Hash: 0BF05035606340DFD7002768B42C3E9BFA8DF43328F05D4FBDA55D7052DD2458858394

Function 04E025D1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 096db3852dd4565b1992f8749fd4e2ffbfc14f32945e0680cc61eddd0df8339c
Instruction ID: 9af210485ea2e4ec05ffe65742ccee726fad9414398071e4825db1c4a51cb1bc
Opcode Fuzzy Hash: 096db3852dd4565b1992f8749fd4e2ffbfc14f32945e0680cc61eddd0df8339c
Instruction Fuzzy Hash: 73F09032A14014CBCB0C9BA9E0155EDB7B2EFC9220B21C03ED956B7290EF345D19D791

Function 04E01431 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6b75cabda4d1ce4e54ec2f3ca2e79b9ff596346c59e8b506fef9937f573c2a
Instruction ID: ecba97fd4b493f8b8bf249a444ef1823de60fb5045ff95353f3822471ae55022
Opcode Fuzzy Hash: cf6b75cabda4d1ce4e54ec2f3ca2e79b9ff596346c59e8b506fef9937f573c2a
Instruction Fuzzy Hash: E7F09074B45206DFDB0C9F74617912A7BAAEF81718745186AC14ACF2A1FD3AD842C3C2

Function 04E025E0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a32de9e649d902a2af1bb70488413372b086d7daf7c9b65b385cd1a5c8664c8
Instruction ID: 2ff0d6708d6d13b42a6b441c65796e74ab31523c000b68873b14dc4b46bb006c
Opcode Fuzzy Hash: 8a32de9e649d902a2af1bb70488413372b086d7daf7c9b65b385cd1a5c8664c8
Instruction Fuzzy Hash: B0E0E532B1015487CB0C9669E4584EEB7B6DBC8220B11803AD916A3340EF705D09CBD1

Function 04E02654 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ccf8f53363f0a4c86e16174fb0b57adc8387637e699e328ba0ef3a0716b5e92
Instruction ID: b1ffae78cfa546c75782c0fbfe4836244f8f1c4304cefe55b88493e31484eac0
Opcode Fuzzy Hash: 2ccf8f53363f0a4c86e16174fb0b57adc8387637e699e328ba0ef3a0716b5e92
Instruction Fuzzy Hash: 6BE0922071431912FB382A68651C7A666CE4B4070CF00ACF9C751C76C1ECC0FCC003E1

Function 04E02590 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e439accfee06a19fd89208e0ed086ad6456dc18708a2161eb403292f59e46ca
Instruction ID: fe1381fefb157012b07d7d1dd9d5287ebd515ac9eced474541ff74dcb9bc7491
Opcode Fuzzy Hash: 2e439accfee06a19fd89208e0ed086ad6456dc18708a2161eb403292f59e46ca
Instruction Fuzzy Hash: A1E08670109300CFD71267B9E5151997FA2EF8531474689BACCC15B336DE205D9983C1

Function 04E00C0C Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f909a1de1e92586b0e7f0ec9489db7cf56d360545bea94b0acb9c4adf412740
Instruction ID: d7265061598497675d7dd75bde20e9a7b54c6bfcfb63e4da5ce899562b8b9855
Opcode Fuzzy Hash: 0f909a1de1e92586b0e7f0ec9489db7cf56d360545bea94b0acb9c4adf412740
Instruction Fuzzy Hash: BFD0A7323510286B96046759E895AAABBA9E7863653109437F94283364DD61BC8083E5

Function 04E02A58 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c6d7b1512e8fd5f89e7236cebb9a29b3e6b7673f4aa659f101fde6b4db4328d
Instruction ID: 697706989c55c35a0fc2c5f6406ece7a792b1d940f7e03d0bebbd8ee90caa2a8
Opcode Fuzzy Hash: 8c6d7b1512e8fd5f89e7236cebb9a29b3e6b7673f4aa659f101fde6b4db4328d
Instruction Fuzzy Hash: 45E01270D012099F8740EFB9950165EBBF4FB48204B10C5EDC95CD7240FB329942CB91

Function 04E017F0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4663b098848f58d5069f2e91c9f86ad24e11e2cddc511413501e4bdfef8fdf
Instruction ID: b7f8189fb35b3f9221f86a93be0eaa1bd405950798dc9013be7ed5c6c6d791ca
Opcode Fuzzy Hash: 4f4663b098848f58d5069f2e91c9f86ad24e11e2cddc511413501e4bdfef8fdf
Instruction Fuzzy Hash: 7CD02E363091808FC30AEB95F4595AA3F73BB4B22030480ABEC818B1B5CE3404A0C340

Function 04E00440 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0326cb3570d263fb213af95956e5bac7bb64a6e9e9b15196ce6104f016e3984
Instruction ID: 700126f35b9f2116b4e750168b3b6d7a54480a0938e9f807f56b8af7163a2d39
Opcode Fuzzy Hash: f0326cb3570d263fb213af95956e5bac7bb64a6e9e9b15196ce6104f016e3984
Instruction Fuzzy Hash: 1CC080F7D5E950BFE31609041C915D17730F67130838AC265CC4065047511F745791B4

Function 04E02C37 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1685834431.0000000004E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_4e00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a2f34b7d8d7389cc276a5c41ea204de40dea38c89774065321f84b86dbdcc8
Instruction ID: c4af1ebd20707a8b2630dc4dd26a94aa954d5f10aa1254b7a939497ed745667b
Opcode Fuzzy Hash: 58a2f34b7d8d7389cc276a5c41ea204de40dea38c89774065321f84b86dbdcc8
Instruction Fuzzy Hash: E2C08C1214C3D49DD323A2B028207E5BF880B1212AF4E00EB96888B0E3C40A80989372

Analysis Process: rundll32.exePID: 7552, Parent PID: 7448COMMON

Executed Functions

Function 068E0040 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

\;^q, xrefs: 068E0070

Memory Dump Source

Source File: 00000004.00000003.1742557417.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_68e0000_rundll32.jbxd

Similarity

API ID:
String ID: \;^q
API String ID: 0-2342212615
Opcode ID: 3f5563c92cf2a78fb8fb02968896272780e3d2569327da7b98284bee5ebf02f5
Instruction ID: 58386c021b7d3f2655ea745b392ae7374c7721d64ef0b0b073763fb17b7ff669
Opcode Fuzzy Hash: 3f5563c92cf2a78fb8fb02968896272780e3d2569327da7b98284bee5ebf02f5
Instruction Fuzzy Hash: D6225D30E1061ACFCB54DF74C84469DB7B2BF89304F1186A9E945AB255EB70E985CB90

Function 067F746A Relevance: 20.9, Strings: 16, Instructions: 918COMMON

Download Yara Rule

Strings

@b^q, xrefs: 067F7CEA
c^q, xrefs: 067F82B9
4c^q, xrefs: 067F8316
$^q, xrefs: 067F83D0
`q, xrefs: 067F76C0
4'^q, xrefs: 067F7DA3
(_^q, xrefs: 067F7B5B
$^q, xrefs: 067F7C78
4c^q, xrefs: 067F79B1
|-_q, xrefs: 067F7528
c^q, xrefs: 067F7A7D
4'^q, xrefs: 067F8373
4'^q, xrefs: 067F7D49
$&_q, xrefs: 067F79E4
`q, xrefs: 067F75F4
4'^q, xrefs: 067F7E00

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: `q$$&_q$(_^q$4'^q$4'^q$4'^q$4'^q$4c^q$4c^q$@b^q$|-_q$$^q$$^q$c^q$c^q$`q
API String ID: 0-3238858861
Opcode ID: dbcb23f20461331f30c530ca3679dc64648228680040a729218a15963f709d39
Instruction ID: cd85cba5e150534cf5227a046fe5ce051646b7ed3d9d48247e03599c1ba97781
Opcode Fuzzy Hash: dbcb23f20461331f30c530ca3679dc64648228680040a729218a15963f709d39
Instruction Fuzzy Hash: FDA2C830A4025CDFDB259F64C954AEEBBB2FF89300F1045E9D5096B268DB369E85CF81

Function 067F74C0 Relevance: 20.9, Strings: 16, Instructions: 867COMMON

Download Yara Rule

Strings

@b^q, xrefs: 067F7CEA
c^q, xrefs: 067F82B9
4c^q, xrefs: 067F8316
$^q, xrefs: 067F83D0
`q, xrefs: 067F76C0
4'^q, xrefs: 067F7DA3
(_^q, xrefs: 067F7B5B
$^q, xrefs: 067F7C78
4c^q, xrefs: 067F79B1
|-_q, xrefs: 067F7528
c^q, xrefs: 067F7A7D
4'^q, xrefs: 067F8373
4'^q, xrefs: 067F7D49
$&_q, xrefs: 067F79E4
`q, xrefs: 067F75F4
4'^q, xrefs: 067F7E00

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: `q$$&_q$(_^q$4'^q$4'^q$4'^q$4'^q$4c^q$4c^q$@b^q$|-_q$$^q$$^q$c^q$c^q$`q
API String ID: 0-3238858861
Opcode ID: 998bc4312146f9c21927351e7fb1397ea6f7714e19ce60d5ebeffa7da17247f8
Instruction ID: f575f997c966f6d8bcc32fe8776ad83bda863f921c807d1f1411191bd4d98ed6
Opcode Fuzzy Hash: 998bc4312146f9c21927351e7fb1397ea6f7714e19ce60d5ebeffa7da17247f8
Instruction Fuzzy Hash: 7B92A870A4021CDFDB259F64C954AEEBBB2FF89300F1045E9D5096B268DB369E85CF81

Function 067F0E8C Relevance: 7.7, Strings: 6, Instructions: 155COMMON

Download Yara Rule

Strings

wtonsoft.Json.Linq.JToken>.IsReadOnly, xrefs: 067F2059
ollections.Generic.ICollection<Newtonsoft.Json.Linq.JToken>.get_IsReadOnly, xrefs: 067F207A
ypedList, xrefs: 067F20FD
(bq, xrefs: 067F202D
eAsArray, xrefs: 067F0E8C
tem.Object>.Current, xrefs: 067F203E

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: (bq$eAsArray$ollections.Generic.ICollection<Newtonsoft.Json.Linq.JToken>.get_IsReadOnly$tem.Object>.Current$wtonsoft.Json.Linq.JToken>.IsReadOnly$ypedList
API String ID: 0-348482316
Opcode ID: 23ac3e2e278aab8b871de7cece351e9be8f038869ce9fd2f6952a271da563df5
Instruction ID: 56020a91af22ec54d66e90eebbd64468a296bfb8cb2d759928234e5c7f0b9b4a
Opcode Fuzzy Hash: 23ac3e2e278aab8b871de7cece351e9be8f038869ce9fd2f6952a271da563df5
Instruction Fuzzy Hash: 50412631B601049BEB98ABB99874FBE6796DFC4300F50842DE716EB391CE358D0687D1

Function 067FB9F8 Relevance: 6.5, Strings: 5, Instructions: 271COMMON

Download Yara Rule

Strings

(bq, xrefs: 067FBC0B
'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067FBAA6, 067FBBF0, 067FBC1C, 067FBC48
(bq, xrefs: 067FBA95
(bq, xrefs: 067FBC37
(bq, xrefs: 067FBBDF

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq$(bq$(bq$(bq
API String ID: 0-142968963
Opcode ID: 0204a13c19ee4c4c5846fcde86242cbc6e6a62667d6f7001757ed1e161d784a7
Instruction ID: 457c3e358ef238dd45d2267c7540f8d3e0ffb289abd98e6c813f749fca2422ac
Opcode Fuzzy Hash: 0204a13c19ee4c4c5846fcde86242cbc6e6a62667d6f7001757ed1e161d784a7
Instruction Fuzzy Hash: 89910331B101188FDB54DF79D454AAE7BE6EF88710B1440AAEA09DB3A1EF34DD01CB91

Function 067FB688 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

\;^q, xrefs: 067FB6CC
'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067FB882
|]q, xrefs: 067FB85D
(bq, xrefs: 067FB871

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq$\;^q$|]q
API String ID: 0-819632542
Opcode ID: 1a20f28ab4844712fd862f9a329125e81ae80dbe6b40b62846b20187a389441f
Instruction ID: 06b91c13346ea76c44d2319a5cc1fdc2e5a399ddb65718a3e4a96635768b60cf
Opcode Fuzzy Hash: 1a20f28ab4844712fd862f9a329125e81ae80dbe6b40b62846b20187a389441f
Instruction Fuzzy Hash: 8061D475B641168FD7549B7AC550A7FB6EBBFC4B40B10802ADA06D73A8EE34DC0287E1

Function 067F1080 Relevance: 5.2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

Strings

em.ComponentModel.IBindingList.AddNew, xrefs: 067F10A2, 067F10BA, 067F10C6
llections.IList.get_IsReadOnly, xrefs: 067F1305, 067F130F
(bq, xrefs: 067F11A8
tem.Object>.Current, xrefs: 067F11B9

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: (bq$em.ComponentModel.IBindingList.AddNew$llections.IList.get_IsReadOnly$tem.Object>.Current
API String ID: 0-3083243814
Opcode ID: acf0f4d440f323c677425cd69457fcd484ce43bc695c6435f8ec46994771bfa0
Instruction ID: e5673475307bdfba30997b7de46df6489bb91e7a30a0efefb1ecff83f6afeda7
Opcode Fuzzy Hash: acf0f4d440f323c677425cd69457fcd484ce43bc695c6435f8ec46994771bfa0
Instruction Fuzzy Hash: C571D535B10214DFEB449BB5C854BAEB7A7AFC8310F148029E606EB3A4DE75DC42CB91

Function 067F0C1C Relevance: 5.2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

(bq, xrefs: 067F18BF
adRootValueAsArray, xrefs: 067F0C1C
List, xrefs: 067F1993, 067F19A0, 067F19B1, 067F19C5
tem.Object>.Current, xrefs: 067F18D0

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: (bq$List$adRootValueAsArray$tem.Object>.Current
API String ID: 0-1308260799
Opcode ID: 26eff2d5a4fd98fdb33e9a760160929d7ea4143075fbecea91fea9b4a5847534
Instruction ID: b9988b13c023e6ea47b21e874bb6f3ea2e8d18d79b680834c764b9db666ef28c
Opcode Fuzzy Hash: 26eff2d5a4fd98fdb33e9a760160929d7ea4143075fbecea91fea9b4a5847534
Instruction Fuzzy Hash: 2851E630A14244AFE7549B78D824BBA7FF6DFC9310F14846AD606E7391CE389C05C791

Function 067F30EC Relevance: 5.1, Strings: 4, Instructions: 136COMMON

Download Yara Rule

Strings

LR^q, xrefs: 067F3776
eadRootValueAsArray, xrefs: 067F30EC
(bq, xrefs: 067F380C
tem.Object>.Current, xrefs: 067F381D

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: (bq$LR^q$eadRootValueAsArray$tem.Object>.Current
API String ID: 0-2945817136
Opcode ID: 1c53326d63ba4f9a0be2e4bd55359702d2a641e418fcf9470a9a34765c79b1e6
Instruction ID: 245419496a879719926822bf1c42ce74d2c649677cc460cef2cc0db9789c4dd7
Opcode Fuzzy Hash: 1c53326d63ba4f9a0be2e4bd55359702d2a641e418fcf9470a9a34765c79b1e6
Instruction Fuzzy Hash: AD411334B242549FEB489B389864B7E7BE7EBC5310F14846AE602DB395DE38CC0187E1

Function 067FA228 Relevance: 3.9, Strings: 3, Instructions: 133COMMON

Download Yara Rule

Strings

'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067FA37B, 067FA3D6
(bq, xrefs: 067FA3C5
(bq, xrefs: 067FA36A

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq$(bq
API String ID: 0-1614460405
Opcode ID: 87787be012de864081fa088a57ea2bb4f05ee76ecc2a3d687dca7e19254dcb2c
Instruction ID: be741dcce0347c7cea2f87ef4377c5eae69a99285334edba65e2ebea590c800f
Opcode Fuzzy Hash: 87787be012de864081fa088a57ea2bb4f05ee76ecc2a3d687dca7e19254dcb2c
Instruction Fuzzy Hash: A441C230B04254DFDB55CF69C854B6EBFF2AF89310F248099D949AB392CA75DD02CB90

Function 067F30FC Relevance: 3.8, Strings: 3, Instructions: 67COMMON

Download Yara Rule

Strings

wtonsoft.Json.Linq.JToken>.IsReadOnly, xrefs: 067F3903
CaseNamingStrategy, xrefs: 067F30FC
tem.Object>.Current, xrefs: 067F3914

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: CaseNamingStrategy$tem.Object>.Current$wtonsoft.Json.Linq.JToken>.IsReadOnly
API String ID: 0-3877253254
Opcode ID: c8da9a24f6e44964d3705b9e9413d029557be9f8dee07cac763ffba52693722e
Instruction ID: 52f15f7994a987263758835cb7c76e6dfcb0ff3648fdeeb2bcaab8618d99aedf
Opcode Fuzzy Hash: c8da9a24f6e44964d3705b9e9413d029557be9f8dee07cac763ffba52693722e
Instruction Fuzzy Hash: 5111E320B293981BEB95277458247BE2F998F82724F1444AFCA91CF383DEA8CC0543D1

Function 067F85C0 Relevance: 2.9, Strings: 2, Instructions: 438COMMON

Download Yara Rule

Strings

d, xrefs: 067F8815
(bq, xrefs: 067F85D4

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: (bq$d
API String ID: 0-3334038649
Opcode ID: 7a2653d14bea0a52c0a4ccedc8dab9f3a33d9b670242c956d930700641fcc3c4
Instruction ID: 6a60a2bbb65125fa3a2309c59572b3a7f1400d4f2d73a610f40cbf4268c2f8a9
Opcode Fuzzy Hash: 7a2653d14bea0a52c0a4ccedc8dab9f3a33d9b670242c956d930700641fcc3c4
Instruction Fuzzy Hash: CC029A34A106058FC754CF29C480E6ABBF2FF88314B25C669D56A9B366DB30FC46CB91

Function 067F6C20 Relevance: 2.8, Strings: 2, Instructions: 339COMMON

Download Yara Rule

Strings

'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067F6E4B, 067F6E77, 067F703C
(bq, xrefs: 067F6E3A

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq
API String ID: 0-2690672114
Opcode ID: 0c74c4953249471f11b7d0e61845212a8e983c291117649a56b9aa6991a1090d
Instruction ID: f1d00b7d05897bf0c26c79171ff785c36f61d2caf240237d1373b1fff5dc5c50
Opcode Fuzzy Hash: 0c74c4953249471f11b7d0e61845212a8e983c291117649a56b9aa6991a1090d
Instruction Fuzzy Hash: F4C19D30B202158FCB68DF69C454A7EBBE2BF88700B248969E546DB395DF70ED45CB81

Function 067FE1F0 Relevance: 2.8, Strings: 2, Instructions: 325COMMON

Download Yara Rule

Strings

'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067FE408
(Acq, xrefs: 067FE578

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(Acq
API String ID: 0-1055946238
Opcode ID: 3f54aa5784b561aa5c0d92995dc4fa7130b9e9622d2e750fc73300f02cefca57
Instruction ID: 56dd9e2cd2656bb13122e4bfc6e1edd0e1b57c8d4a8d2db60be9272e0b9fb6fa
Opcode Fuzzy Hash: 3f54aa5784b561aa5c0d92995dc4fa7130b9e9622d2e750fc73300f02cefca57
Instruction Fuzzy Hash: 03C15F70B202199FDB54DFA9D854AAEBBB2BF84300F148429E606EB365DF70DC46CB51

Function 067F99B8 Relevance: 2.8, Strings: 2, Instructions: 324COMMON

Download Yara Rule

Strings

'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067F9D66
(bq, xrefs: 067F9D55

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq
API String ID: 0-2690672114
Opcode ID: 9e397d85eab28c8cbed243f45f8fe2c8d43436c4538e7ffef7b599da506c8048
Instruction ID: 79c61d87bdf9a2ff8192bbf33eb032726b2d68de8968f318836c7d43411a39a4
Opcode Fuzzy Hash: 9e397d85eab28c8cbed243f45f8fe2c8d43436c4538e7ffef7b599da506c8048
Instruction Fuzzy Hash: CCE12934E103598FCB55CFA8C888AADBBF2BF89300F158295D909AB365DB70ED45CB50

Function 067F6048 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

(bq, xrefs: 067F60A1
'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067F60B2

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq
API String ID: 0-2690672114
Opcode ID: f88ff4c9c99f3a14aaa2153d4463b2ce661758286587727de25bea1fa941ad76
Instruction ID: 08676a56c31611fa14e053d01e5a41baf2ea344890b740dc32482d5d3c9ab066
Opcode Fuzzy Hash: f88ff4c9c99f3a14aaa2153d4463b2ce661758286587727de25bea1fa941ad76
Instruction Fuzzy Hash: 60714E70A003189FCB45EBE4D854BDEBFB2EF88300F148429D256A73A5DE35AD49DB91

Function 067F1630 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$^q, xrefs: 067F16CE
$^q, xrefs: 067F16DA

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: b123f453d555a40ed71ccaeee8c3e730fcce4ffd689b9d7217f60807015c359f
Instruction ID: a27e5181a14962879e772a2a0c8b0c4df4c35a6a3e7389cb5f40d37af827afbd
Opcode Fuzzy Hash: b123f453d555a40ed71ccaeee8c3e730fcce4ffd689b9d7217f60807015c359f
Instruction Fuzzy Hash: 2F51E435B102099FC754DF78D8509AEBBF6EFC9250F54812AE618DB365DE318D02CBA1

Function 067FC4D8 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

(bq, xrefs: 067FC526
'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067FC537

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq
API String ID: 0-2690672114
Opcode ID: c2283b1e38b85f4df3cac240eff2596a4cbbffa34d01d65b59566cd5bf528012
Instruction ID: c60ab924ee87978bfc4fb8999005ae05d0420c1ff2862ed18983f2c210fb0f7c
Opcode Fuzzy Hash: c2283b1e38b85f4df3cac240eff2596a4cbbffa34d01d65b59566cd5bf528012
Instruction Fuzzy Hash: FE51D2317147458FC326DB34D458A2BBBF2EFC5210718CAA9D58A8B766DE30EC46CB90

Function 067F1D58 Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

List, xrefs: 067F1E4B, 067F1E57, 067F1E67, 067F1E7A, 067F1EA5
tem.Object>.Current, xrefs: 067F1D8C

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: List$tem.Object>.Current
API String ID: 0-534641084
Opcode ID: e86e5aeae00c38d1c33f2f3a0245ebd06e21b616fb24ed533a59fa4ec6fb3bc0
Instruction ID: 9740b26b1d92495f28b332afe9d3a7219a1b3de5364d4c41528d881c184b8525
Opcode Fuzzy Hash: e86e5aeae00c38d1c33f2f3a0245ebd06e21b616fb24ed533a59fa4ec6fb3bc0
Instruction Fuzzy Hash: 2F41B231A54208EFD788DBA4D825AFA7FB6DF89311F104069DA09D73A1CE398D46C791

Function 067FEA88 Relevance: 2.6, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067FEAE4
(bq, xrefs: 067FEAD3

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq
API String ID: 0-2690672114
Opcode ID: 1e089770d11d5d6cffeaf2c5d545e2e08cd20e0e70ff2479d5bfb633c724b528
Instruction ID: 33b560bef0c4b5e007a99bc0d0c2e0c6ea30ceb05d397ab586fcd1c2b4692e6d
Opcode Fuzzy Hash: 1e089770d11d5d6cffeaf2c5d545e2e08cd20e0e70ff2479d5bfb633c724b528
Instruction Fuzzy Hash: 2531CE30B202059FEB589B3ED455D7EBBA6EFC46507144539E606CB3A1DE70DC028BA1

Function 067F45C8 Relevance: 2.6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

Strings

'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067F4623
(bq, xrefs: 067F4612

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq
API String ID: 0-2690672114
Opcode ID: 81f7cd517d734fa9e52a302ff015d3819156c4dd7cb52785357b36f3540a69bc
Instruction ID: 76a8b38a6aa7d586a57a34a08442ff60d429d257735c6d5a94a15f3b6007b885
Opcode Fuzzy Hash: 81f7cd517d734fa9e52a302ff015d3819156c4dd7cb52785357b36f3540a69bc
Instruction Fuzzy Hash: B021C1353012459FD714AB3DD854D2A77EBEFCA21072540AAF249CB36AEE34EC46C7A1

Function 067F57B8 Relevance: 2.5, Strings: 2, Instructions: 47COMMON

Download Yara Rule

Strings

'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067F5812
(bq, xrefs: 067F5801

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq
API String ID: 0-2690672114
Opcode ID: e476e475058301c921737f9664598bada822dac39e0b18badeb51e4ffb7d414c
Instruction ID: 2c20c2cf6d439a80e345ddc74ac6e707b41c61f6d2ca6cf8dec7d90c96786481
Opcode Fuzzy Hash: e476e475058301c921737f9664598bada822dac39e0b18badeb51e4ffb7d414c
Instruction Fuzzy Hash: 3B01F2303152418FD715AB3DD86092E3BE79FCA21032886BAE14ACB7A6DF35EC06D351

Function 068E9FE0 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 068E9FF8

Memory Dump Source

Source File: 00000004.00000003.1742557417.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_68e0000_rundll32.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8e6ecfcac7331df307d5c32398bd2ebc5d3c6f5a81c73abad4c81285e2a36ca5
Instruction ID: 4612e3d734d876f0da8b3f1ad79e2f71792e8d3d962070b510d0d5d910507cb3
Opcode Fuzzy Hash: 8e6ecfcac7331df307d5c32398bd2ebc5d3c6f5a81c73abad4c81285e2a36ca5
Instruction Fuzzy Hash: F3115035E01204DFDB68CB79D4443EDB7A1EB86738F148125D615E32D0DB339909CB50

Function 068E9FD0 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 068E9FF8

Memory Dump Source

Source File: 00000004.00000003.1742557417.00000000068E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_68e0000_rundll32.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 87224daaaebb4d1850affc22115aef384fcc6921db095f3a4c25007b26d89869
Instruction ID: 0a318b04252eddd70eb752b7751e3b142a9fd0c87e87a9e76a1c3b6cf27708c0
Opcode Fuzzy Hash: 87224daaaebb4d1850affc22115aef384fcc6921db095f3a4c25007b26d89869
Instruction Fuzzy Hash: B3115035D02344DFDB29CF34C8443EDBBA1EF8A728F144558D951E3190EB329949CB91

Function 067FBE40 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

Q,l^, xrefs: 067FBF58

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: Q,l^
API String ID: 0-236176976
Opcode ID: bbac0193f4595329f991e7771d41e50707bfa153ebb2dc52a76d568b0fecdadb
Instruction ID: 2142021410a966d099e4825dd38cb0760dbbf1912b6ff20eb7a6d7e207171852
Opcode Fuzzy Hash: bbac0193f4595329f991e7771d41e50707bfa153ebb2dc52a76d568b0fecdadb
Instruction Fuzzy Hash: 79B14B74B006058FDB55DF39D59896EBBF2FF88200B048669EA46CB365DB30EC46CB91

Function 067FBE33 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

Q,l^, xrefs: 067FBF58

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: Q,l^
API String ID: 0-236176976
Opcode ID: a6609e1e8fdb944d53cf9432c48f0c4c9ed7a3e2fcd6b1afe075e57b8a43fb5c
Instruction ID: e76e073df514f8be11fde7412d8f45ffedf6d16e80e5273e1d129e7f6cd3fa95
Opcode Fuzzy Hash: a6609e1e8fdb944d53cf9432c48f0c4c9ed7a3e2fcd6b1afe075e57b8a43fb5c
Instruction Fuzzy Hash: 45718D74B002018FCB55DF39D59496EFBF2FF89200B048669EA56CB365DB30E946CB91

Function 067F68E0 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

(bq, xrefs: 067F6953

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: bfdaab8fa626802c5b7574895119ec57cdedf2314715d5636adda6a0094fda72
Instruction ID: cd054d071bf4c5d9d90bbc3d44a36f702bbf3048c81fa1a9797cf5919771c605
Opcode Fuzzy Hash: bfdaab8fa626802c5b7574895119ec57cdedf2314715d5636adda6a0094fda72
Instruction Fuzzy Hash: 18614D35B002159FCB11DF68C880DAABBF6FF8931071480A9E659DB321DB31ED15DB90

Function 067F34A8 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

roperty, xrefs: 067F3672

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: roperty
API String ID: 0-3756821849
Opcode ID: f5e073949a636b78aedb7372264d9fe17f889fc0172356ade9dd94192a98b747
Instruction ID: 548e8bbfd19c50aff35782c73ffe7e2c5eca763c117380df6acf87de66ad286c
Opcode Fuzzy Hash: f5e073949a636b78aedb7372264d9fe17f889fc0172356ade9dd94192a98b747
Instruction Fuzzy Hash: FA5183343552065FCB49EB38D56196DBBB2EFC4204B008629E505DB369DF70ED4E8BD1

Function 067F34B8 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

roperty, xrefs: 067F3672

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: roperty
API String ID: 0-3756821849
Opcode ID: 1104b298fad485b0d262bcc17d753d7f8e7c2fc60f7abe7299d05223d4c9e5a4
Instruction ID: 92579a35935b5ebc87b77b94b0421f05bf14e0d51906863827f3fa3268ea1fc2
Opcode Fuzzy Hash: 1104b298fad485b0d262bcc17d753d7f8e7c2fc60f7abe7299d05223d4c9e5a4
Instruction Fuzzy Hash: C15184343511065FC749DB38D56196DBBA3EFC4204B008628E509DB359DF70EE4E8BD1

Function 067FE428 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

(Acq, xrefs: 067FE578

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: (Acq
API String ID: 0-1548273396
Opcode ID: f309e4c8368a8bdf2f0009c57f176d42a10c84f8d1b0f59102b198d176208134
Instruction ID: 5f671cdffa7d7c68621f46c2aa2111256115abac521f05da5fbf3d9164c5dab2
Opcode Fuzzy Hash: f309e4c8368a8bdf2f0009c57f176d42a10c84f8d1b0f59102b198d176208134
Instruction Fuzzy Hash: 6D414070B20215AFDB54DF75D854EAEBBB2BF88240F108529E515EB350EF709C05CB91

Function 067F85B0 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

(bq, xrefs: 067F85D4

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 9c82255e5f2f5b8458f416829b051ade1180f35f6aef77446636f851519ab7d6
Instruction ID: 2a785c648b6b3081bcee66b85fb3fcd969e72ed0acf97384bcf91c885df9096b
Opcode Fuzzy Hash: 9c82255e5f2f5b8458f416829b051ade1180f35f6aef77446636f851519ab7d6
Instruction Fuzzy Hash: 3A417B34B206058FDB54CF59C480A6EFBF2FF89314B158569E55AAB351DB30E841CF91

Function 067F6720 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

N content found and type '{0}' is not nullable., xrefs: 067F6729

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: N content found and type '{0}' is not nullable.
API String ID: 0-3389148967
Opcode ID: 3205236458387d5d100533bd02203e7c91c6e7edb37d3b4f2775a61a329a1722
Instruction ID: 002d725a32d1512ff6988a416bec651505686a3f291f03dee4233934df4e96bc
Opcode Fuzzy Hash: 3205236458387d5d100533bd02203e7c91c6e7edb37d3b4f2775a61a329a1722
Instruction Fuzzy Hash: CE41BE34E10208DFCB54DBB8D544AAEBBF6EB84310F508569D2199B346DB30ED4ACB90

Function 067F3719 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

LR^q, xrefs: 067F3776

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 3818fe527789f80fc9e22e62b2c95be9a72c8c1df7bc5afe869e27ed2a38e84a
Instruction ID: 0c2061aee1436fb930f3e05b178be82d0683bc2083f5cacfe159f3780ec11009
Opcode Fuzzy Hash: 3818fe527789f80fc9e22e62b2c95be9a72c8c1df7bc5afe869e27ed2a38e84a
Instruction Fuzzy Hash: 1F21E470B252459FEB888B34D895B7F7BFAEFC5224F10442EE606C7395EA34880187A0

Function 067F310C Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

Key, xrefs: 067F310C

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: Key
API String ID: 0-3000888649
Opcode ID: 247befb9bde6be0172361f40263c28bcb2bca61de3ab3a851d737fd23c660df5
Instruction ID: 1e696cff32a7d2509537734214e7d9a1666187a18c3e3c75baa0c1407a334dc4
Opcode Fuzzy Hash: 247befb9bde6be0172361f40263c28bcb2bca61de3ab3a851d737fd23c660df5
Instruction Fuzzy Hash: 23212C316663596FDB4627756815BFA7FA8DF42234F148067FF988A352CD288846C3D0

Function 067F66E0 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

N content found and type '{0}' is not nullable., xrefs: 067F6729

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: N content found and type '{0}' is not nullable.
API String ID: 0-3389148967
Opcode ID: d5510e6a761c1a07d4c1a505ccba9e65719ffb276d16218bdf5059af8fba9c3b
Instruction ID: 084911f7e293f4468eefaba8f9b86719f10ec33a339e15f0c58b0831117adc99
Opcode Fuzzy Hash: d5510e6a761c1a07d4c1a505ccba9e65719ffb276d16218bdf5059af8fba9c3b
Instruction Fuzzy Hash: CC31003091A3909FC7028B68C9949AABFF5EF87314B0485ABD185CB353C734DC89CBA1

Function 067F28F8 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

ldInfo, PropertyInfo, EventInfo or MethodInfo, xrefs: 067F29B6

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: ldInfo, PropertyInfo, EventInfo or MethodInfo
API String ID: 0-245375412
Opcode ID: 94c65454d9e187bddb50e8f06cc9a45c3deb8379f761a9bfb6a7668c2b40ebd9
Instruction ID: 8bdcb4b983dfe9288c44bac5d99241a254b6bb503fc44f4ef6dcaddafaf49bc9
Opcode Fuzzy Hash: 94c65454d9e187bddb50e8f06cc9a45c3deb8379f761a9bfb6a7668c2b40ebd9
Instruction Fuzzy Hash: EB217C6155E3D06FD703AB78A9606D53FB09F53204B0601D3D0C0DF1A3EA248D4EC7AA

Function 067FAAA7 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

l, xrefs: 067FAAA9

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: 3b439f00d8c21985d17f3e25c62ac1d1be11d3fd917ca7f35314e014ebc984ff
Instruction ID: 851f17e361d9b47317ea0510e61747d5c91bce72532cc6458c16c353876bfee2
Opcode Fuzzy Hash: 3b439f00d8c21985d17f3e25c62ac1d1be11d3fd917ca7f35314e014ebc984ff
Instruction Fuzzy Hash: 3031B434D0A349DFCB41EFB8C4509ADBFF1AF89300F5144DAD585AB366DA349A44CB91

Function 067F1BB0 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

tem.Object>.Current, xrefs: 067F1B63

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: tem.Object>.Current
API String ID: 0-3680341460
Opcode ID: a8e2966c659ed46ec6e620be757a89f15b614268ab41a3098686779cb18eda1f
Instruction ID: f04ceb21ba669dbe33830810b3e0314f02e73e6d911be718dd38f1c16cedda42
Opcode Fuzzy Hash: a8e2966c659ed46ec6e620be757a89f15b614268ab41a3098686779cb18eda1f
Instruction Fuzzy Hash: 6D115934B29380DFD7AA17349C54B7B2F569BC1250F0444AADB45CB343DE288C03C3A0

Function 067FAF10 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

\;^q, xrefs: 067FAF58

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: \;^q
API String ID: 0-2342212615
Opcode ID: 85280ed1f7d2690883f06dd6fd26ae09d79069e612b5aa128bfafcc9c111ec5d
Instruction ID: 4d3203d4f1985ebb7ff97ac16b1ad522e685fab377f0ff516fe03a046f6789f3
Opcode Fuzzy Hash: 85280ed1f7d2690883f06dd6fd26ae09d79069e612b5aa128bfafcc9c111ec5d
Instruction Fuzzy Hash: 8211C6327142054F9B949BAEA48496BF7DAEFC8664314803BF60ECB358EE71EC004750

Function 067F5F48 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

LR^q, xrefs: 067F5F66

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: aa27c215a43a70b5674c4ac5427ac0c07a6b7c77e12dd6f37e4cdaa8640a4792
Instruction ID: c0834678bd2a9cd2c66995b05de02482d9626aa9d165965ede6400ad5ecc3ceb
Opcode Fuzzy Hash: aa27c215a43a70b5674c4ac5427ac0c07a6b7c77e12dd6f37e4cdaa8640a4792
Instruction Fuzzy Hash: 75216F34B201089FDB589F69C459EAEBBF6FB88710F248059E602E7391DEB19C01CF95

Function 067F5F46 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

LR^q, xrefs: 067F5F66

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 3ca702871fe5effdc6e54e1d1fc1027b9bd8b87a1bf6943a6beabb5d5cae752b
Instruction ID: 3a052f29c338f9e37ebb06f7c996932df494bb3ff2bb61e3f3c29e040ce13a8f
Opcode Fuzzy Hash: 3ca702871fe5effdc6e54e1d1fc1027b9bd8b87a1bf6943a6beabb5d5cae752b
Instruction Fuzzy Hash: 14218134B201049FDB589F68D459EAE7BF6EB88710F208019E602E7391DEB19D018F91

Function 067F3370 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

fcq, xrefs: 067F33D6

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: 52a3162aeeb1ddfce233f07d508b5375ad40aaf911108c5f970fe6ecadb636ad
Instruction ID: 58829b3aef9fe39db59f23320bb23bbf00d36bf924c58c87a1d915485077de08
Opcode Fuzzy Hash: 52a3162aeeb1ddfce233f07d508b5375ad40aaf911108c5f970fe6ecadb636ad
Instruction Fuzzy Hash: 80119039B051055FDB199FB49854ABEBFB6EBC8700B10802AF945D7245DE3489068B91

Function 067F3A35 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

List, xrefs: 067F3A63, 067F3A6F, 067F3A7F, 067F3AA9

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: List
API String ID: 0-3841611558
Opcode ID: 306662b0a505f452b0a69c8dae6d577648e5c51c0ae180e5ced2e49e56b7031c
Instruction ID: ed827a3e202a878581a63ad687e1626bdf86ce6325fd0b8c7d7643785a6cd2a5
Opcode Fuzzy Hash: 306662b0a505f452b0a69c8dae6d577648e5c51c0ae180e5ced2e49e56b7031c
Instruction Fuzzy Hash: BF115E34A10105AFEB48DFA5C854EEA7BF6EFCC310F148029E519A73A4CE799D46CB90

Function 067F3A38 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

List, xrefs: 067F3A63, 067F3A6F, 067F3A7F, 067F3AA9

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: List
API String ID: 0-3841611558
Opcode ID: f05cbb5035ba279bf33bba98a34a5a963bd5700ac0ec6405cf81819945552a6f
Instruction ID: 0ff4ead13a34c72673972158640ec59b8b2c6ff7a8f3a5e170015853bbf1ce09
Opcode Fuzzy Hash: f05cbb5035ba279bf33bba98a34a5a963bd5700ac0ec6405cf81819945552a6f
Instruction Fuzzy Hash: 51112E34A10105AFDB44DBA5C854E9A7BF6EFCC310F148025E519A7394DE799D45CB90

Function 067F1958 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

List, xrefs: 067F1993, 067F19A0, 067F19B1, 067F19C5

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: List
API String ID: 0-3841611558
Opcode ID: 51e6e07f09e71c86ab5d9d10702f1bfcd97672636a5ba054a30fc38af676d61f
Instruction ID: 84d70b8d297f5446ab87df23b2e9fda4f4c82b9b2ac336691067284ce8fe953a
Opcode Fuzzy Hash: 51e6e07f09e71c86ab5d9d10702f1bfcd97672636a5ba054a30fc38af676d61f
Instruction Fuzzy Hash: AD212C35A00254EFEB44DFA8D455AE9BFB6EFCC320F154019E509E7360CA799D45CB90

Function 067F3380 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

fcq, xrefs: 067F33D6

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: 3f12b29df710f9bca820616cae37c5768a352c823a9e5e7996789b4ec1e44647
Instruction ID: 2f5b790a3ecb4ffa0ca04712b3161be90d0d9b0387beaef26946e2d60456e991
Opcode Fuzzy Hash: 3f12b29df710f9bca820616cae37c5768a352c823a9e5e7996789b4ec1e44647
Instruction Fuzzy Hash: D2118239B001145FDB489FB598449BFBFB6FBC8610F008029F909D7340DE748D028B95

Function 067F1E20 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

List, xrefs: 067F1E4B, 067F1E57, 067F1E67, 067F1E7A, 067F1EA5

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: List
API String ID: 0-3841611558
Opcode ID: 26bc60d737fa792546655125c1f0af54dd22946d5182bcc1049f1846f23082b9
Instruction ID: c8105be1dc63238ba4e9b98958c1ee78f12e1ba4dbc01a484e6e8c8ad95cb3c2
Opcode Fuzzy Hash: 26bc60d737fa792546655125c1f0af54dd22946d5182bcc1049f1846f23082b9
Instruction Fuzzy Hash: 69110734A40104EFEB48DFA5D855AA9BBF6EFC8311F148029E509A73A4CE399D49CB90

Function 067F2998 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

ldInfo, PropertyInfo, EventInfo or MethodInfo, xrefs: 067F29B6

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: ldInfo, PropertyInfo, EventInfo or MethodInfo
API String ID: 0-245375412
Opcode ID: b2cb52ae7b8cf7b69775ae350f90120094cd97826a9d89aaf9a85296f10a7e54
Instruction ID: 5bbb3d012410e0c430f246d2078f78c7e9e0debd9f7a0e531171ebc9c09c81f7
Opcode Fuzzy Hash: b2cb52ae7b8cf7b69775ae350f90120094cd97826a9d89aaf9a85296f10a7e54
Instruction Fuzzy Hash: 0401A17195A3809FC746CB74AA11BE57F70DB82104F1145A7E194EF263EA249E0A8B91

Function 067F1440 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

ypedList, xrefs: 067F1487, 067F148C

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: ypedList
API String ID: 0-3412083367
Opcode ID: 62d9b067405023d66e178b9f52f7f145d98229544d59518a55e3732cf711b2d2
Instruction ID: 5939d8e97b4087e1d4ce3b2ad1f82ec655d4ca76835eb2d730e63b430b21b36b
Opcode Fuzzy Hash: 62d9b067405023d66e178b9f52f7f145d98229544d59518a55e3732cf711b2d2
Instruction Fuzzy Hash: F001D830A1A3455FDB0D9FB468315767FE9DFC250470508AAC64ECF262E928D80AC7D2

Function 067F1968 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

List, xrefs: 067F1993, 067F19A0, 067F19B1, 067F19C5

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: List
API String ID: 0-3841611558
Opcode ID: 089ba5f34d1e7b7be9f0c0c95786909d2ebdb87a710bc49365130b3142bd9e5c
Instruction ID: 00091439edee96103b193286fb32e260b96040193e85c06a29b846d384da620a
Opcode Fuzzy Hash: 089ba5f34d1e7b7be9f0c0c95786909d2ebdb87a710bc49365130b3142bd9e5c
Instruction Fuzzy Hash: C411E935600115AFEB04DFA4D459AE97BF6EFCC311F144019E50AE73A0CA799D45CB90

Function 067F1431 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

ypedList, xrefs: 067F1487, 067F148C

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: ypedList
API String ID: 0-3412083367
Opcode ID: fc5f8da4b6248ac9c1240e6b16a90d983870e4f2eee966ca403d1c9603d20940
Instruction ID: 07fd388860dd515060211d5c421ff0f15304306c7bd16ed6c137cea7bb07a3f0
Opcode Fuzzy Hash: fc5f8da4b6248ac9c1240e6b16a90d983870e4f2eee966ca403d1c9603d20940
Instruction Fuzzy Hash: 48F0C230A552059EEB4D8FB855255BA7FD6EBC261870508AEC249CF261E938C806C7C2

Function 067FA369 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067FA37B

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo
API String ID: 0-1435625925
Opcode ID: cf83ab8dc52555876b12c6d64aaf071d6d054d5facedc293a6bb763f3ba3d6fd
Instruction ID: 971fab8326cd1faf583d0c3f155d247eba89985c5fc1b37cdb41a221133f60f6
Opcode Fuzzy Hash: cf83ab8dc52555876b12c6d64aaf071d6d054d5facedc293a6bb763f3ba3d6fd
Instruction Fuzzy Hash: 23F0F6316092918FD7165B348414529BFA69F86215B2880EEC9894F246CF279D03C791

Function 067F0C0C Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

sArray, xrefs: 067F0C0C

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: sArray
API String ID: 0-2593908834
Opcode ID: 3cac582a8bb6df4c848e10f53ad67d92ab81d480d742679058268ee3ea411b37
Instruction ID: 8c1ab4873f3bcca8940922dcf961e8e8c33cc0e532b7cc709cd74f198f5ae827
Opcode Fuzzy Hash: 3cac582a8bb6df4c848e10f53ad67d92ab81d480d742679058268ee3ea411b37
Instruction Fuzzy Hash: 79D0A7323700186B5A446718D895CEABB99E7852707508433FB06D3324CD71AC4087D5

Function 067F99A8 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0ec9efed16d235c3e9a9f3d56ce2c21fe61aa67b69ad3e834ccc96a6f6fcf8
Instruction ID: 2a73afbaf819355f4d786e0ba04c543569ec38d667b704a0d9cbfffe7b418e15
Opcode Fuzzy Hash: 8b0ec9efed16d235c3e9a9f3d56ce2c21fe61aa67b69ad3e834ccc96a6f6fcf8
Instruction Fuzzy Hash: 9BD10934E103598FCB55CFA8C988AADBBF2BF89300F158195D948AB365DB70ED45CB50

Function 067FABA0 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ec73c88c6ff0a30370ca213bc66edad2c004563b901419b94a4830a66c45e1
Instruction ID: d665e01f632a8cf250dea4e0388ed1a50297f9204430493a611ebc8ee5317ebc
Opcode Fuzzy Hash: c9ec73c88c6ff0a30370ca213bc66edad2c004563b901419b94a4830a66c45e1
Instruction Fuzzy Hash: D3510834760101CFDB889F2AD598D2A77E7BFC961132981A9E60ACB379DE31DC41CB40

Function 067FE7D8 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02f97dc4faca101b82c58c6098a2397a2a2298a9300f703cc8dbf9c4f7baa1f
Instruction ID: 301b7eccd341c189f50f8b25b639d4b4c8a3e9b8145bb8dc460cb1680670b02d
Opcode Fuzzy Hash: b02f97dc4faca101b82c58c6098a2397a2a2298a9300f703cc8dbf9c4f7baa1f
Instruction Fuzzy Hash: 02617E30B10205AFDB58EF79D594A6EB7F7AF88604B208429D506E73A0DF709D05CBA1

Function 067F6C10 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86b783ff903cbe46c1c4f2ea774edf058af8ba5a50d9b6c68137c844cf51dfb
Instruction ID: 9691ca0b8fea1f74292d3e9e4e1af1832d153fe024203ff395d80f0b57d75131
Opcode Fuzzy Hash: f86b783ff903cbe46c1c4f2ea774edf058af8ba5a50d9b6c68137c844cf51dfb
Instruction Fuzzy Hash: 1D519D30B102068FCB44DB68C944EAEBBF2FF84310B258569E945DB3A5DB30ED45CB90

Function 067F5483 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36ab7515afa7f0c5c801b2df51ee4aeaebbef780f50cb937237447f141270c8f
Instruction ID: 4d9add59ed0648ac525e5e3d8ebfea67a82a9ef34c464a351708a947ec65587f
Opcode Fuzzy Hash: 36ab7515afa7f0c5c801b2df51ee4aeaebbef780f50cb937237447f141270c8f
Instruction Fuzzy Hash: D9510174A00209DFDB49DBB4D955AAEBB76FF88300F108429E616B73A4CF319D45CB61

Function 067F60D9 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fb7412fcac4585f4a8cb3885568bdf7598bb438b1e36a322d0e8d3fdfdb9d2
Instruction ID: 9f7ef22974b32a77adcb243130bb794f7265d2f6961204b5af3bb4a5f6a0fce6
Opcode Fuzzy Hash: 46fb7412fcac4585f4a8cb3885568bdf7598bb438b1e36a322d0e8d3fdfdb9d2
Instruction Fuzzy Hash: 5B51CAB4A402089FDB45EBE4D894ADEBF72EF88300F144029D216B7365DE35AD49AB51

Function 067F5490 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a146e404e60f96ddf54c90ac6e4ccb7d28b9bcd6bf2ac333d97b2a61ca2fc676
Instruction ID: b39bbbfb81d6ee3addbe6f377b08a98963e0577d5afcae86d909861795335d47
Opcode Fuzzy Hash: a146e404e60f96ddf54c90ac6e4ccb7d28b9bcd6bf2ac333d97b2a61ca2fc676
Instruction Fuzzy Hash: 8251CD74A00209DFDB48EBB4D959AAEBB76FF88300F108429E616773A4CF319D45CB61

Function 067FB4F7 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20dba539b550b3f5383a37174a1513e80a840cf89f2b9f28371c256b5430f2a5
Instruction ID: 037273d16d50f3f66ab15695778cf8f1ab0bf0397277e03bc7fcb868ff1f2b98
Opcode Fuzzy Hash: 20dba539b550b3f5383a37174a1513e80a840cf89f2b9f28371c256b5430f2a5
Instruction Fuzzy Hash: B341A53555E3D09FDB139B389D64AAA3FB1DF43210B0940E7E5C1CF2A3DA648849C7A6

Function 067FE7C7 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e44ed6814a1780e9d4725110d06595ce59653bd769cf9edf2130c1fcaa8c2d
Instruction ID: 2f2ae24b5dbb7d019b3c1da6de9e7e248edd5ced1ef3220a750b4da9007154c0
Opcode Fuzzy Hash: 31e44ed6814a1780e9d4725110d06595ce59653bd769cf9edf2130c1fcaa8c2d
Instruction Fuzzy Hash: 8841A231B10105AFDB58EF79D454ABEBBF7BF88600B208429E516E7390DF719D068BA1

Function 067F1F08 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a23346417721a1b7477c19a1c27abd095c236c8931c6fe7e057c48dbfd4b88
Instruction ID: 4bf31a9025e32ec621dd264d452b9b4463b15b40dec124a21748a448b6da6258
Opcode Fuzzy Hash: 21a23346417721a1b7477c19a1c27abd095c236c8931c6fe7e057c48dbfd4b88
Instruction Fuzzy Hash: 10316832B19245AFC7A95BA57821E7A7FDACBC2150F45442BD70CCF352DA389802CBA1

Function 067FE1E0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93dde66b57be0881d2fdf2aa41bf9d99b20d2852fe9d04be0ab0feb9b252b1ec
Instruction ID: dacb18477ad931d8d49d2e8de8fc036bb4aaeaf2c88be545a7bca89472d6edfa
Opcode Fuzzy Hash: 93dde66b57be0881d2fdf2aa41bf9d99b20d2852fe9d04be0ab0feb9b252b1ec
Instruction Fuzzy Hash: D0417A75E112499FCB14CFA9C4849AEBBF2FF89300F248169E901AB365DB30ED46CB40

Function 067FF69B Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef840bb85a291ee5201e7fbf98861c07c47282be35152ab3ef3a4169e883785
Instruction ID: 8d69b23e4426f55a3907679314873d0c51c162a835c1134a0886bfaca359fbbf
Opcode Fuzzy Hash: fef840bb85a291ee5201e7fbf98861c07c47282be35152ab3ef3a4169e883785
Instruction Fuzzy Hash: 2F41BE30B042558FCB15DF38C89897EBBFAAF89200B144569E246C7366DB34DD49CBA0

Function 067F2268 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc6ad51a8d7b5254c98a35441aa8e395047be3b5f9692ab7d9a6c4510771820b
Instruction ID: 792432e1da652eacdb565be22936ded77328123dbc3a5d0eda5b17eb37ce8ad2
Opcode Fuzzy Hash: bc6ad51a8d7b5254c98a35441aa8e395047be3b5f9692ab7d9a6c4510771820b
Instruction Fuzzy Hash: 94410A79B101149FCB54DFB8D88499EBBB2FF89710B108169EA15EB361DB31DD42CB90

Function 067FF6A8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fceeee3b04e3503bfaff64f76e772f02619334314eb8b203ca3c547059d98244
Instruction ID: e3a5b91380497299735615d70dba0ef8751fc0515fa4fd2fb9be329e64e89e1f
Opcode Fuzzy Hash: fceeee3b04e3503bfaff64f76e772f02619334314eb8b203ca3c547059d98244
Instruction Fuzzy Hash: 5041DF30B002558FCB24DF38C888A7EBBF6AF89300B044569E246C7365DB74E949CB60

Function 067FB080 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ea55e66d398dcef8eea03aad4b6b17f1f8e4946fc88070eb967cf701b530c3
Instruction ID: cb5a8a3a365e559231d66f9e594eedc0a2aed16103b5e19a99368c4777ce3888
Opcode Fuzzy Hash: 96ea55e66d398dcef8eea03aad4b6b17f1f8e4946fc88070eb967cf701b530c3
Instruction Fuzzy Hash: E1319E35B101058FCB50CBA9D984EAEF7AAFF84614B14C16AEA19C7355DB71E801CB90

Function 067FC558 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80dc151e9dc44958bb1987766f1abada924aad4d3ee521a03206c4b12873c13d
Instruction ID: 6c7758239623011734defa05ead9f7b8577e52ce49e28d57790937b7b00dfbba
Opcode Fuzzy Hash: 80dc151e9dc44958bb1987766f1abada924aad4d3ee521a03206c4b12873c13d
Instruction Fuzzy Hash: 2C3190352147458FC326DF34D598927FBF2EF893107188A69E58A8B766DB30EC46CB90

Function 0094D6A4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1748854643.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_94d000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b682f1f4572078168afc721564d4118737137ef76e62d161a5e238c3100337
Instruction ID: a6471a102e12031951d45826368e892e3f9e6a95c3b48b4eb42ba9a5d983ee6c
Opcode Fuzzy Hash: d2b682f1f4572078168afc721564d4118737137ef76e62d161a5e238c3100337
Instruction Fuzzy Hash: 942137B9605240DFCB05DF14D9C0F2BBFA5FB94324F20C569E9094B256C33AD856CBA1

Function 067FB598 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b42d14cf97407ca56dd3e2c1a4aebd78290d286843b2e889ad3fa5b00ed577
Instruction ID: 56f640b2aba49457b18be8aec870ec55ce6ffd0985c9b74c4fd8419a0b82661c
Opcode Fuzzy Hash: d3b42d14cf97407ca56dd3e2c1a4aebd78290d286843b2e889ad3fa5b00ed577
Instruction Fuzzy Hash: 1B21B038B50208CFDB499F75D849AAA77B6EB84B01F008475FA058B351EF71D846CB90

Function 067FB930 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86953402c54eef6fcf18c4c02e964369adf791d633125d604e32c8cfb34d87f4
Instruction ID: d0fdf2f99a2fdfc8aaeceef671a335fbe489d4df5aa668b9096b42bd03215ce3
Opcode Fuzzy Hash: 86953402c54eef6fcf18c4c02e964369adf791d633125d604e32c8cfb34d87f4
Instruction Fuzzy Hash: 39115E327642058F9794DB2DD890E3AB7DAEFD8660714C03AAA4AC7358EE71EC018390

Function 067F46A0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cccfbada9a233e4c128189d80f948bfd547e52889aadad1d0e28f9e0906d5327
Instruction ID: c1935022078c63c5c443aa764db67867255604632b9d6f5bc8fcded215f35c94
Opcode Fuzzy Hash: cccfbada9a233e4c128189d80f948bfd547e52889aadad1d0e28f9e0906d5327
Instruction Fuzzy Hash: 2911C431716384AFD7119B688804C6A7BEAEF8A210B1540DAF685CB357DA359C06C7E1

Function 067F4553 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563db7954264928d020308976b24a4bd53c42d5f1306252c090521832b3d9d80
Instruction ID: fd393e8c3168489d7946a4081431b696430adef3a00f262328069785564ee38a
Opcode Fuzzy Hash: 563db7954264928d020308976b24a4bd53c42d5f1306252c090521832b3d9d80
Instruction Fuzzy Hash: C011E6303042464FC725AB7CE95492EBFE6DFC5250314457EE68ACB31ADB20DD498795

Function 067F2258 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea6bfc38712f3705ff5e2fc6c92e83505dd30de4ca7cbc1c6d049087b615967
Instruction ID: 6c35f66ba7a14bf2b8a72bc8cf2899314eb81e42c10eb82cfd5f62ea6e41fdac
Opcode Fuzzy Hash: dea6bfc38712f3705ff5e2fc6c92e83505dd30de4ca7cbc1c6d049087b615967
Instruction Fuzzy Hash: 43210B75E201149FCB94DFA8D8849EEBBB5FF8D710F10812AEA15EB321D7319942CB90

Function 067F46C8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e80ff29ec46165619d0d4622421f792b3a78c99e3b83680414d17dba3fe706
Instruction ID: 6be405c0bd49f10db1a0425787988e0a0291bdd612786350bc8d9758c5e5ab43
Opcode Fuzzy Hash: b7e80ff29ec46165619d0d4622421f792b3a78c99e3b83680414d17dba3fe706
Instruction Fuzzy Hash: CA119434B05208AFCB40DB68D844D9EBBFAEF89310B0140AAF649D7359DA349D05CBD1

Function 067FA219 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08fffc7c2928ec9993dee23831f5ab8c9896a801a5058407584b35628ff0052
Instruction ID: 13fa4f8b27f96bf646682db61c9a11d783a2a631656479ab66d734097651b9a6
Opcode Fuzzy Hash: c08fffc7c2928ec9993dee23831f5ab8c9896a801a5058407584b35628ff0052
Instruction Fuzzy Hash: 9A214A30A14209DFDB15CF66C584FAEBBF5AF88710F258059E949AB341CB71ED45CBA0

Function 067F0F20 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2d8f489dbf08404d78e62ec8bf728dd0e2e41dfc9bb7e90e873bcb2bbe2d13
Instruction ID: 25d5688a5116ed5491b1f1bc89beee95e591c116becd36f3887302ae3b19e978
Opcode Fuzzy Hash: fd2d8f489dbf08404d78e62ec8bf728dd0e2e41dfc9bb7e90e873bcb2bbe2d13
Instruction Fuzzy Hash: C9018935B2D390ABCB9917791C68E3B6F9A8FC5260F0145BAEB08C7302DD248C00C2E1

Function 067F576F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80813d1f3c0927a075e03beb7526051ff287265a0f2ad97fb062013dc4d39984
Instruction ID: a2784219d439ee8e2afcfad5ed93db851ba7612b6660da81d1a650403f084081
Opcode Fuzzy Hash: 80813d1f3c0927a075e03beb7526051ff287265a0f2ad97fb062013dc4d39984
Instruction Fuzzy Hash: B11159313053404FC765E778D8509ADBB92DFC5220314C57EE25ACF61AEF609C4E87A0

Function 067F6038 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133da101e9339c82009c7b61e57f75853b7d1527b210ed39b1a77063e59d4d4a
Instruction ID: 02cb992d52decd8c94856a3c5303de936946b9358ad78d1a2acd42c95d9e38fa
Opcode Fuzzy Hash: 133da101e9339c82009c7b61e57f75853b7d1527b210ed39b1a77063e59d4d4a
Instruction Fuzzy Hash: 9611B130624754CFC7618F68D408A9ABBF2EF45318F14886EE58687362DBF1A849CB51

Function 0094D69F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1748854643.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_94d000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 402c6a8559748647fef594cd0c7d6ed57cea98399c5c457cfc3d558c3163147f
Instruction ID: f8a48a8db7e4ce5514d58d1ae1ef1a28c5a189ee7d2ca8c072716f6aed23ff11
Opcode Fuzzy Hash: 402c6a8559748647fef594cd0c7d6ed57cea98399c5c457cfc3d558c3163147f
Instruction Fuzzy Hash: 7B11D3BA504280CFCB16CF10D9C4B16BF71FB94324F24C6A9D9094B656C336D85ACBA2

Function 067FAAE0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feff64378375e0f50f9baa2c094991015cd53a767ab31f716f1f6d20553204a9
Instruction ID: 5adbf55dd865ff68610a961e2e857668686cc8ce6799c06553152e8298728a33
Opcode Fuzzy Hash: feff64378375e0f50f9baa2c094991015cd53a767ab31f716f1f6d20553204a9
Instruction Fuzzy Hash: 1F21FC74E0120DDFCB44EFA8D590AAEBBF2FF88310F508599E505A7354DB74AA44CB91

Function 067F1378 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd4552658f3d114bb6d9c21563b7302ee042b796030f2b9f2d6dd276ce54806
Instruction ID: 35dd24fb9fc06dc0aedf4b96f22335fdc876ce2611acc9196771260f3bd0df0d
Opcode Fuzzy Hash: ddd4552658f3d114bb6d9c21563b7302ee042b796030f2b9f2d6dd276ce54806
Instruction Fuzzy Hash: 9F21F0B1D04249CECB20DFAAC480AEEFBF0EF88324F10852AD559A7250C7356945CFA5

Function 067F1380 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1123cc27d72e3897eaa894a516d1e0e5cd0ed1242cd7d705ca5a08aa67c467b
Instruction ID: 1c960b6c17c340b5799dd0c0478726606f52a4a64cbca7ec5f95cc6934563899
Opcode Fuzzy Hash: a1123cc27d72e3897eaa894a516d1e0e5cd0ed1242cd7d705ca5a08aa67c467b
Instruction Fuzzy Hash: 511110B0D002098ACB10DFAAC880AEEFBF4FF88324F10842AD559A7250C7746945CFA5

Function 067FB070 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f70a0059262dd153907b6dba2420875060e475665ecf64050f10962bc4f3b5e
Instruction ID: 9074d75683582780b3c861111e818c7e3131a05f3b92eda52b389f9a00216fcd
Opcode Fuzzy Hash: 3f70a0059262dd153907b6dba2420875060e475665ecf64050f10962bc4f3b5e
Instruction Fuzzy Hash: A101F7347042464FC7119B699940A5EFFF6EFC524070881BEDA48C7356DB75D845C7A1

Function 067F182B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c442668e4570ca43dd714c8f6be075737d4b5ca8baa8b502d1bb348374981ef8
Instruction ID: 98f18c8ffebc36c48c70ac5068ef2eadb8f441a0cdbbd3a55b07a8c394061400
Opcode Fuzzy Hash: c442668e4570ca43dd714c8f6be075737d4b5ca8baa8b502d1bb348374981ef8
Instruction Fuzzy Hash: CC018471A2010497E758EB688565BAF7BF69BC8710F50842DD216E7381CE755D0187E1

Function 067FB920 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd02a13356b896f402e5e03645bfb9208fc4407c9ebd1487d8b05e55ceecc97
Instruction ID: 20ad4d92624aa4e8a1b70eb2aad6d2a43d910c58155553ad64f92ba000316b9b
Opcode Fuzzy Hash: 3fd02a13356b896f402e5e03645bfb9208fc4407c9ebd1487d8b05e55ceecc97
Instruction Fuzzy Hash: 3401DF313443818FD754CB28D890A7ABBEAAF89220718406EA989CB352DE21DC05C360

Function 0094D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1748854643.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_94d000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d7bfbdb172a63516d5045d759d42d4f0c1fe5a88bdc8040920554e451b6025
Instruction ID: 21e3bacaea945dc6855ee4047de850f06ff46f132f1d39a3f4281db8ff94f5af
Opcode Fuzzy Hash: f3d7bfbdb172a63516d5045d759d42d4f0c1fe5a88bdc8040920554e451b6025
Instruction Fuzzy Hash: B901D67540A340AAE7208A29CD84F67FFDCEF41364F18C92AED484B296C279DD41C6B1

Function 0094D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1748854643.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_94d000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca5f778a71d7c233531360bbf9b80612e04bcaa5b2b99f225f6efbd686e89b6
Instruction ID: f741b70875ba27191670f92fc6c3553cdb4f838aceb1b22c9ce01d69298e1063
Opcode Fuzzy Hash: 9ca5f778a71d7c233531360bbf9b80612e04bcaa5b2b99f225f6efbd686e89b6
Instruction Fuzzy Hash: FC010C6140E3C09ED7138B258C94B56BFB8EF53224F1985DBE9888F1A7C2699849C772

Function 067F56C3 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f9fb93fdec6580298281cff5353bd03defaf4dffebcbc76a646702e2656696
Instruction ID: f612d2512ceea05cfd2e07bc47125b663150b5fecf376c0460c4f4cee4869f36
Opcode Fuzzy Hash: 06f9fb93fdec6580298281cff5353bd03defaf4dffebcbc76a646702e2656696
Instruction Fuzzy Hash: A401F2302043406FC325A779A864A6EBF96DFC1304744856DE24ACB356DFA1E94D87B2

Function 067F5753 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec7e479e78405f8a96f7ed5d55c0545c2ae9d9f80bab39c5f7c47c345d8e4fb
Instruction ID: 402b81a4bc056a466340b48ef36fce31d1c3372ed7fd68014ad4ff5a49792b58
Opcode Fuzzy Hash: 3ec7e479e78405f8a96f7ed5d55c0545c2ae9d9f80bab39c5f7c47c345d8e4fb
Instruction Fuzzy Hash: 1C01F7302047054FD3559BB8D85066EBB96EB80300B408569E24ACB719DF74D84D8BE1

Function 067FCB90 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d3740af0b544433f5e287ae54456f931f7d8cad03c2b43ef1e49b772903cb9
Instruction ID: de1a983fb0eb568eb96a16fcf68a96289b8c5f8450d83d5310e1fefb44a60435
Opcode Fuzzy Hash: 57d3740af0b544433f5e287ae54456f931f7d8cad03c2b43ef1e49b772903cb9
Instruction Fuzzy Hash: 73F0903A7291189F97459F6DAC84A3FB7FAFBC49A1714493AE609C3350DB61CC01C794

Function 067F858F Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c499e48c17ee86495fe2232f883bd079dcd8ad0cb53dbc7525c8445bfe4296
Instruction ID: d971468ec7b0c6a44e0b589f2ba451f3bbb1a1e1a3d328435a6c96891044a980
Opcode Fuzzy Hash: b9c499e48c17ee86495fe2232f883bd079dcd8ad0cb53dbc7525c8445bfe4296
Instruction Fuzzy Hash: E2014971A143418FCB55CB68D840D3DBBB2DF95210719816EE7968F366DB21CC40CB51

Function 067F4F3E Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a220e849f142979bcd7950892a0ef39402cfe00265c92c8ac9887c9920228e5d
Instruction ID: 4ce09b6b1a2b7a403369f4a266cab9ca3c60ea3d15b2a624aaf3bd00dbc6cbf6
Opcode Fuzzy Hash: a220e849f142979bcd7950892a0ef39402cfe00265c92c8ac9887c9920228e5d
Instruction Fuzzy Hash: EE01DE31740205CFCB05DF68D98099EFBA1EF8431471486A9E5199F32ADB31EE5ACBD0

Function 067FEA75 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d0be71e5ecfc6c447c1405b4729afc294860e6daba299b1fccdbfb5d7cb655
Instruction ID: 8fc17d52f0e2a6a933b581a410dc34149fa6c21f11b3d0b363cc74c4486fbc1b
Opcode Fuzzy Hash: c7d0be71e5ecfc6c447c1405b4729afc294860e6daba299b1fccdbfb5d7cb655
Instruction Fuzzy Hash: 71F024313083011FC7161B7D845096AFFFAEFCA52032900BEE188CB3A2DE698C02C762

Function 067FCB7F Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbf9dbed7c2bac5bf2c620e34913d3320f610a1c76804d9b7a986ae65c02adb
Instruction ID: 5735ae745c660006ed7626a7dec470be4c5b32c0639b5ceca01e7a6841c2534b
Opcode Fuzzy Hash: 6cbf9dbed7c2bac5bf2c620e34913d3320f610a1c76804d9b7a986ae65c02adb
Instruction Fuzzy Hash: BFF0C2357093595FC3124F299850A2BBBF9EF8555031508AFE584C7352DA208C05C791

Function 067FE3EB Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b5d6b80ef7f9ffb3dc3a8ba3fe1b6e01037e25177d4d94737b9196631e8f9f7
Instruction ID: d82e5f303c1a89a44970b92dcd89d91e6c1327d97c3fe2dd3b33a1d827fd7adb
Opcode Fuzzy Hash: 6b5d6b80ef7f9ffb3dc3a8ba3fe1b6e01037e25177d4d94737b9196631e8f9f7
Instruction Fuzzy Hash: E901D6767602109FD71597A99851BBD7763EFC4710F108116E7025B354DBB16D0B8BC0

Function 067FE36A Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d113002964f2be215b5b248486809189b905d7bfe9afe37328c90ecbb92e15cc
Instruction ID: d77c8cf074eb8fd063efe867b6e1e24f3c042844287244e065a21d45f9c866e1
Opcode Fuzzy Hash: d113002964f2be215b5b248486809189b905d7bfe9afe37328c90ecbb92e15cc
Instruction Fuzzy Hash: D0F02236BA02104FD71597A98811BBD7763FFC8660F14812AE706AB340DFB1AD0B8BD0

Function 067FAF00 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b5f8e38413b57b7e3d4db927053dcf3ca2ac3917b4e652ae3b254c6a2d5900
Instruction ID: 7a9fde9aeb42849e2f0f2b3f60af8e9e436cb4fe965f8f0ba9585c9dd3a19bc4
Opcode Fuzzy Hash: b9b5f8e38413b57b7e3d4db927053dcf3ca2ac3917b4e652ae3b254c6a2d5900
Instruction Fuzzy Hash: 4DF059713083452FC7A64B6E6840C67BFEEAECA160304806BF94DCB352DD21DC0883A0

Function 067F56D0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c18d70a1d4ade407537b3dbcf073432e63a1a3f1fe709a4b994796b0d48265
Instruction ID: 3bde822ce6d5f922379ecefb92059cbfba437b62338a6f6ef1c21cf523ffb807
Opcode Fuzzy Hash: 50c18d70a1d4ade407537b3dbcf073432e63a1a3f1fe709a4b994796b0d48265
Instruction Fuzzy Hash: 27F0C2303006055FC768ABB9D454A6EBBD6EBC43107408A2CE20BCB359DFB1E94D87A1

Function 067FCA43 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788b4d6f37f49441a40f6239a5e1bbadd932a9c8d1e686ddc99b05769e1ca54c
Instruction ID: da29b7eeca3a63464e412691ba8ca64e5f9411678b097a13167d85c4878cef63
Opcode Fuzzy Hash: 788b4d6f37f49441a40f6239a5e1bbadd932a9c8d1e686ddc99b05769e1ca54c
Instruction Fuzzy Hash: C1F0585211E3E40FDB139B3809A56A6BFF18C5320870A04CBC9C2CE1A7D108A95ED3A6

Function 067FC4C9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee85554b6b6cb853ca48a4dbfcb16cf0f9a4b3ba8a517b146d8aab164d00f803
Instruction ID: 14c42a9f42585cb64af5d595ba884cf2df95d8de5db0593cf3592e6f1f7b3869
Opcode Fuzzy Hash: ee85554b6b6cb853ca48a4dbfcb16cf0f9a4b3ba8a517b146d8aab164d00f803
Instruction Fuzzy Hash: F9F0E9312583862FC3235B356800AAFBFE59EC325076805AFD9C58B256EA61D888C391

Function 067F68D1 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851c5f714910203755d28ccd34b4a1487044e168ed3c7b751425bbce34e652c8
Instruction ID: 5f10043de8c1b75d2d2222e41a6ee47af03c62f522d3bfe49b2c0a5ca60bcbe3
Opcode Fuzzy Hash: 851c5f714910203755d28ccd34b4a1487044e168ed3c7b751425bbce34e652c8
Instruction Fuzzy Hash: AFF09036A0429A9FC716CF68D800D99BFF6EF8A21030980DBE988CB262D731D905CB50

Function 067F57A8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91da81a64fd052e098fc6c6d2f2cf99dfd1af97892704933fcfb810b478aaed7
Instruction ID: 82c83869dc718ccf793c44c2f09376d23fb68573ed21ee263ba44b5ab524f1ca
Opcode Fuzzy Hash: 91da81a64fd052e098fc6c6d2f2cf99dfd1af97892704933fcfb810b478aaed7
Instruction Fuzzy Hash: A2F0B4303153459FD7119B38D850D6A7BE5DFC621030944BEE585CB366EB21DC45C790

Function 067FAEBF Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e9000f0c4d2f044963ec9548c125c3e92eb8b3f0a4657b96a2734260aea97f
Instruction ID: 1b50bf5bc7ddeff802db8deae9dc9a81641291aae4e208c8a2af6da3c95644cd
Opcode Fuzzy Hash: 91e9000f0c4d2f044963ec9548c125c3e92eb8b3f0a4657b96a2734260aea97f
Instruction Fuzzy Hash: 04F0E22121E3C54FC7630B70282928EBFB0CE83164F6988EBDAC5CA097C629480AC721

Function 067F45B8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb3363ee0edbf733ce21d0620472bfa4adb2102db48c06666f46ea8138b2cda
Instruction ID: c8c96f602262e8637256f3639089575c6683c02c3a04f1e5bdf17824b730ccbd
Opcode Fuzzy Hash: abb3363ee0edbf733ce21d0620472bfa4adb2102db48c06666f46ea8138b2cda
Instruction Fuzzy Hash: F9F0E9303042428FC7119B7CD95496E7FF29FCA214318456AE185CB366EB20DC46C751

Function 067FC688 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d4ed72998dfb35b70f76e30cef0127d9e549e635d8d0c4ca07eb523da0657f
Instruction ID: 9da41123ff9b193dbaf16f3007e3e5907e4da0fddd07d1d3f977da635409bbb2
Opcode Fuzzy Hash: d6d4ed72998dfb35b70f76e30cef0127d9e549e635d8d0c4ca07eb523da0657f
Instruction Fuzzy Hash: D6F0E535B202168FC748D779E9009B7B7DAAF882A430491B5EA08C7738FE71CC02CB80

Function 067F38B0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4fcc5ab7ad300226d62ee8ffc4c2ff9aece206ef4bfcebb9fd8a675ed9d82fe
Instruction ID: 26f2a191b2eb5aabc410a29d94a0dbd6bcff92cd64a7e08d012aba288b8079b3
Opcode Fuzzy Hash: b4fcc5ab7ad300226d62ee8ffc4c2ff9aece206ef4bfcebb9fd8a675ed9d82fe
Instruction Fuzzy Hash: 75F08C60A397990AEBA1537419007AA3FE80F42738F2500AFCED1CE387DE84C84583E1

Function 067F36A9 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3ac6e822f8acd16eb064e8abb307798bdbe17efdd443b45f39f2f4e994f832
Instruction ID: 9d6f95b001186e74a287b5484a4a51dd148256939f7ac126ce0d2365c77a2ff7
Opcode Fuzzy Hash: fe3ac6e822f8acd16eb064e8abb307798bdbe17efdd443b45f39f2f4e994f832
Instruction Fuzzy Hash: 43F037B1D1525A9FDB54DFB899006EEBFF4DF09160B20846ED959D7201E33186058BD0

Function 067F4560 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc4a9a47cd3e8b7af6756a60c262ff2b18c4423ed90887e7970648f7cb5a42d
Instruction ID: 05a80e1bbcd8b0f88ea0a3e0ed07be33ef040421f37c59c7ba9810f6f3a6314b
Opcode Fuzzy Hash: afc4a9a47cd3e8b7af6756a60c262ff2b18c4423ed90887e7970648f7cb5a42d
Instruction Fuzzy Hash: 1BE022313006041B8229A37EA82491FBBC6EEC4260300853DE22ECB309DE20EE494399

Function 067F3CFF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384191726f9c25b05913777bd6329fa4041872341913b01f612e724335c2e549
Instruction ID: 7bcee4f5c717ad9c51e81b348880b5a1072b484b1c1c036c44cdf0b364e0ddd1
Opcode Fuzzy Hash: 384191726f9c25b05913777bd6329fa4041872341913b01f612e724335c2e549
Instruction Fuzzy Hash: 22F0A770809249EFC751CF74A9225ADBBF5DB5620072441DFD989C7252DA319B48CBD1

Function 067FAB90 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89081c931d4ee6afbb9cfbee9554ecd09476d1fe062d59196b5b426f688c4b89
Instruction ID: a70b32f2d33b90687afc6bca1113d5646276535e6236363e552173ec8d4af19f
Opcode Fuzzy Hash: 89081c931d4ee6afbb9cfbee9554ecd09476d1fe062d59196b5b426f688c4b89
Instruction Fuzzy Hash: 52E0A0313143048BD3245B39A448A6ABBEAAB89265F2445BDEA0AC3352CA20C8048340

Function 067FC1D0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 753b40e831eba6594d9e856904b593e276f1078de97de02c6fd766ed85265fbc
Instruction ID: 87ed1c902a98efbe2a52caba4960f87160cdaa8fbf9146f4b588dec83d509c15
Opcode Fuzzy Hash: 753b40e831eba6594d9e856904b593e276f1078de97de02c6fd766ed85265fbc
Instruction Fuzzy Hash: 8CF0A9302093840BC7226B68A01865EBFE6EF86318B04046EE9C2C7252CA606849CBA1

Function 067F3CC0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f174c3e8f326112450cda49fdec1cc71ffdf73c348a2388c5bd2948407e7e5d8
Instruction ID: 396ec68272004ca629cf0494c02fbf7f3a08b268f54ba116f3d36ece0ba7cacc
Opcode Fuzzy Hash: f174c3e8f326112450cda49fdec1cc71ffdf73c348a2388c5bd2948407e7e5d8
Instruction Fuzzy Hash: B7E092223093A05BC71266BD242956DBFAACEC252171800AFEAC5C7682CA55880583E2

Function 067F6AAF Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05432b80063f4eb848a1d2acf19d062f9e6dc521fc6140d26d1e86e3c15a2945
Instruction ID: c082618d008d5b65faa3e879ebe8eedea1fc5967ed13d0384dd2567feba3d095
Opcode Fuzzy Hash: 05432b80063f4eb848a1d2acf19d062f9e6dc521fc6140d26d1e86e3c15a2945
Instruction Fuzzy Hash: D5F030312083559FC712DF58D850D55BBF4AF5621471581AAE988CB363D721EC05CB91

Function 067FC678 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bfceafdc8bdc4a3a104a46454775371c47dce6233c89a9538d1d134e2cee163
Instruction ID: e27356c6d070340d2b4e0892a95770fd0815c6ba9c59a7040ccf28354c070f66
Opcode Fuzzy Hash: 7bfceafdc8bdc4a3a104a46454775371c47dce6233c89a9538d1d134e2cee163
Instruction Fuzzy Hash: 4CE0D8356183464BC31747308910667FFE65F4A154B1855EADD848A257DA75C882C791

Function 067F36B8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cfa8bbc40a4569aa7e3c07af7d9aef3d38a138ce3fc30ebf22d8fba1c64544d
Instruction ID: ba691fc0bfe565869d3754d71cb45d34d417113fe8259e2d4bc2baee780b51db
Opcode Fuzzy Hash: 0cfa8bbc40a4569aa7e3c07af7d9aef3d38a138ce3fc30ebf22d8fba1c64544d
Instruction Fuzzy Hash: 8BE01270E2021ADF8B80DFA999005AEBBF4AF48150B108569D619E7300F3729A11CBD1

Function 067F17F0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8083bd470a47f3453b6253e0ab00c14290c54dd3b4147f58dd58236e3e09b458
Instruction ID: 3ef204a48e17a2e42fb2f3123ca37856ca7313850b3d24899f66519467a7bc7e
Opcode Fuzzy Hash: 8083bd470a47f3453b6253e0ab00c14290c54dd3b4147f58dd58236e3e09b458
Instruction Fuzzy Hash: BBE07D325281400FC3491B14B8214F07F7947571203040067FBA5CB362C9600C03C7E0

Function 067F3C89 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2170c4dec615b274990f85c0b7e87cc20551edfa7bbe4bb08620e6e6ee692c16
Instruction ID: 761d643178c458d3a883e9627b2112e99ce588b56baaca9e0b0e20b47059f509
Opcode Fuzzy Hash: 2170c4dec615b274990f85c0b7e87cc20551edfa7bbe4bb08620e6e6ee692c16
Instruction Fuzzy Hash: FEE0263071E3D5CACB06177534285A83FA08E8205931C09EFDACEC3B83C202C408C781

Function 067FCAC0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10469f8ddddae386256d0318d58390a3efb5e7e403be28a608d331d0260d80f0
Instruction ID: 4183e890ea330348bd87325d8c3b721416362766b768fb3d64a72d14e58a4ac5
Opcode Fuzzy Hash: 10469f8ddddae386256d0318d58390a3efb5e7e403be28a608d331d0260d80f0
Instruction Fuzzy Hash: A0E0EC1115E7E40FDB13AF78567419A7FB64C83204B1904CBC9C28E0A7D549A89DD35A

Function 067F6898 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd159d96578de41051b436a8960634034999d10129525d48d5fc5d9756ed912
Instruction ID: b51c6cb083134eeb6006c3b0c1f7b3502f5b4ef6231e881c6d35fd66d8b9e323
Opcode Fuzzy Hash: 9cd159d96578de41051b436a8960634034999d10129525d48d5fc5d9756ed912
Instruction Fuzzy Hash: FAE012311053959FC3224B38A514652FFF5DFCB25032545ABE884C7157CA608C86D790

Function 067FC1E0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05197e748bb9e157839c8b2d8c81267931328ff9a24643ccb7e88532c9e0cb58
Instruction ID: 229dbcdd9e5d117014b15476d46ddce355ebcc6097889bc5f6238aa762e74476
Opcode Fuzzy Hash: 05197e748bb9e157839c8b2d8c81267931328ff9a24643ccb7e88532c9e0cb58
Instruction Fuzzy Hash: 4EE0C2312003044BC214776DE04C95E7BDAFFC9764B00052DF686C7705CE71B8458B94

Function 067F3CD0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18ae7e304c542bb4f593f5ca41fd92119df943b9fefe826d66df955845ffd05f
Instruction ID: 8bbbaf8657359af612e25384be3c48b6000a2822b7ac58cd167926a2b27527a1
Opcode Fuzzy Hash: 18ae7e304c542bb4f593f5ca41fd92119df943b9fefe826d66df955845ffd05f
Instruction Fuzzy Hash: E2D05E3631012453065422AE742D92E779FCBC5961308012EE70AC3744CE518C0543E5

Function 067F6AC0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c62cdc0053f5918537ec23a5692af3c45102f35cf74d3ea06e5e8aeafb88dd13
Instruction ID: 014c625cd3c813c00ab713c24b7ee33dab6fd70c3490f920111fdefc485c2ef3
Opcode Fuzzy Hash: c62cdc0053f5918537ec23a5692af3c45102f35cf74d3ea06e5e8aeafb88dd13
Instruction Fuzzy Hash: 51E08C353002088FC310DF4CD880C92BBE9EF59210315809AE948CB312C722EC02CB90

Function 067F46D8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a71f5496270dd5331ef999c2a503ac68016c7a2461000d21bc2a3057838d11c7
Instruction ID: 0a72fee42938c3c753af76b0888ded41b19669694787c45975a9db4290e9f878
Opcode Fuzzy Hash: a71f5496270dd5331ef999c2a503ac68016c7a2461000d21bc2a3057838d11c7
Instruction Fuzzy Hash: 7EE0B674E4420CAFCB44EFE8D54459DFBF5EB48300F0081AAE809E7364EA349A448F81

Function 067F3938 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da655f489ef2cbed350ef50fc166096c6a31c0824ee204e6993737f6262e8074
Instruction ID: e40a7c4c20ef8be3a25913eaac29ba3de4e3018a93faea5a51a481b592d27f14
Opcode Fuzzy Hash: da655f489ef2cbed350ef50fc166096c6a31c0824ee204e6993737f6262e8074
Instruction Fuzzy Hash: 2DD02E11A6E3945BC70513B02818AA86FA8CF82A20F1108DFCE989B343CC688C024380

Function 067F3D10 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d9aa1bd8ab12f125764e24f14a5d6929bc9b7ccef3ed5520edfc649cb08102
Instruction ID: d0b44a9b5909781779a145628ed2f6b7b42a7e4637f4ec8f6046fb3480417d72
Opcode Fuzzy Hash: 98d9aa1bd8ab12f125764e24f14a5d6929bc9b7ccef3ed5520edfc649cb08102
Instruction Fuzzy Hash: CCD05E30A4110DEFCB44DFB8EE2299DBBFAEB45200B1081A9E509D3340EF31AF049B90

Function 067F0440 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8543851dd85e521ac43ab52f4ef858560f441386105dc085cbba79bd741b81a7
Instruction ID: 7e66bf0d565cc2bf06c9b59bb8992b79713c38d7ba5f73d66263d34f821d3e42
Opcode Fuzzy Hash: 8543851dd85e521ac43ab52f4ef858560f441386105dc085cbba79bd741b81a7
Instruction Fuzzy Hash: BDD0C7B293D7C05FD792879805544F8BF61FA7720978A4597C185C4613D22DD457C732

Function 067FE32A Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498f68d46596f488620920969054bef22a2418cd5b399e21c7768d431fec700e
Instruction ID: 360534abbf7d88fb2e814b65bd0d625fe4ab5d9f3a9b3e524659867868851589
Opcode Fuzzy Hash: 498f68d46596f488620920969054bef22a2418cd5b399e21c7768d431fec700e
Instruction Fuzzy Hash: 70E01270A6460BDBDB54DFE0C598EAE7771BF44309F204415D501A6364DB75850ACF82

Function 067F2968 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6846fc4e874ba5ab8d25aeaddaad0ce78fab50647aab229a63d503bc0db36f7d
Instruction ID: 88fbb8963f6385fd10279aec597263ba8843ec84a1e4234b0de9074a74bf72fe
Opcode Fuzzy Hash: 6846fc4e874ba5ab8d25aeaddaad0ce78fab50647aab229a63d503bc0db36f7d
Instruction Fuzzy Hash: 9CD05E74945209DFCB08DFB5E94599DBFF9EB44204B2086A6E408D3210EF305E05CBC0

Function 067FA3A8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c3086d7e959c8cfaa4fc9004d87d512d3341d9133719a61966bbfeed636212
Instruction ID: 879a6236c85255e536eb5f9b596e22dc272026a5dd8ce908cad53f129f9227ae
Opcode Fuzzy Hash: 75c3086d7e959c8cfaa4fc9004d87d512d3341d9133719a61966bbfeed636212
Instruction Fuzzy Hash: 2DD01235605319DBCA055A55D900865B76AAF8556872880ACD94C0F715DE33EC43CBD0

Function 067F3C98 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680e099c25027cceb4d26fe11fe5e1d4a4d85627fa556171f4f68eee76953289
Instruction ID: 3b63cec6f8e925b745d8c59f41d891693234d4669900339137b4d4342d70f319
Opcode Fuzzy Hash: 680e099c25027cceb4d26fe11fe5e1d4a4d85627fa556171f4f68eee76953289
Instruction Fuzzy Hash: 90D01230724204CFDF8CDB68E96D9757799DB8861830488ACAA0FC7381DF22E803CAC4

Function 067F46B0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7473742f3360895f8c6161d8071ab73e18695bf7084e1b4e79385d5415bd33
Instruction ID: 8852bc75330cb5a187c575a93f3f2af58861646f397a09c9751e9f2e8b52842f
Opcode Fuzzy Hash: fd7473742f3360895f8c6161d8071ab73e18695bf7084e1b4e79385d5415bd33
Instruction Fuzzy Hash: BEB0927094530CAF8620DB99990185ABBACDA0A310F0001D9F90887320D976E91056D1

Function 067F0E7C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba57c3ea4e74c9830275957def0154ca8207ac7aaa40a1285416b29796d50d3
Instruction ID: bb5a3cfbab92630df6f89a2bb7f3e6c5fffb517ea16ec12c9844c64ae4a129be
Opcode Fuzzy Hash: 6ba57c3ea4e74c9830275957def0154ca8207ac7aaa40a1285416b29796d50d3
Instruction Fuzzy Hash: 01B01265564001D67AC4A7354CF8C7680C29AC0300FC0CC115712A032DCD18D0000009

Non-executed Functions

Function 067FF7E8 Relevance: 8.9, Strings: 7, Instructions: 148COMMON

Download Yara Rule

Strings

(bq, xrefs: 067FF8F4
Hbq, xrefs: 067FF8B5
'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067FF8C6, 067FF8D8, 067FF905
`]cq, xrefs: 067FF86A
,bq, xrefs: 067FF844
,bq, xrefs: 067FF850
`]cq, xrefs: 067FF876

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq$,bq$,bq$Hbq$`]cq$`]cq
API String ID: 0-2140728097
Opcode ID: 3d60fbda0184584a8660f33eb0484ce67a866efe3beb0495d1389c517f5c9530
Instruction ID: 340a229a6dcd8325ad6e7b2fea04e71ba65e86fb120901967226f35a77999726
Opcode Fuzzy Hash: 3d60fbda0184584a8660f33eb0484ce67a866efe3beb0495d1389c517f5c9530
Instruction Fuzzy Hash: 14412931B241248FDB646F3EE41486D37EAEFCA62132444AAD246DB3A1CE39DC45C7D5

Function 067FEFF8 Relevance: 6.5, Strings: 5, Instructions: 234COMMON

Download Yara Rule

Strings

'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067FF0FE, 067FF27C
,bq, xrefs: 067FF227
(bq, xrefs: 067FF0ED
,bq, xrefs: 067FF21B
(bq, xrefs: 067FF26B

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq$(bq$,bq$,bq
API String ID: 0-1403887619
Opcode ID: f1f26f7962d1102a838f47a788d519e0f54ffdf4db4154176483e47ab71f41e0
Instruction ID: cc551745cbd7aaa1da8e2ba58d93419477dcb5c67a07bc68c3a9cc9242dd44ac
Opcode Fuzzy Hash: f1f26f7962d1102a838f47a788d519e0f54ffdf4db4154176483e47ab71f41e0
Instruction Fuzzy Hash: 76818F35B102458FCB54DF69C898E6EBBF2EF89244B248469D606DB361DF35EC01CB61

Function 067FC3A0 Relevance: 5.1, Strings: 4, Instructions: 110COMMON

Download Yara Rule

Strings

Xbq, xrefs: 067FC4AE
(bq, xrefs: 067FC468
'{0}' must be of type FieldInfo or PropertyInfo, xrefs: 067FC3DE, 067FC479
(bq, xrefs: 067FC3CD

Memory Dump Source

Source File: 00000004.00000003.1742530332.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_67f0000_rundll32.jbxd

Similarity

API ID:
String ID: '{0}' must be of type FieldInfo or PropertyInfo$(bq$(bq$Xbq
API String ID: 0-3094324217
Opcode ID: ae217dea6cfc92aed68957c922071ae3b8c63a808b17d6e63f8040e3ee385838
Instruction ID: 5d7b3c6251210a1a647a66b6270123d757fb5ad576935ce54ecf1d4576b49b75
Opcode Fuzzy Hash: ae217dea6cfc92aed68957c922071ae3b8c63a808b17d6e63f8040e3ee385838
Instruction Fuzzy Hash: 1931F6313093948FD3569B38C410A6A7FE6AF8764071984EFE585CB7A3CE28DC06C791

Analysis Process: rundll32.exePID: 7652, Parent PID: 7448COMMON

Executed Functions

Function 04C250B8 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

\VMm, xrefs: 04C25375

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID: \VMm
API String ID: 0-3195670953
Opcode ID: c163452d9212d071307ac11b793e2936b65b18f0a8bd1f9c817cef19e19e0cca
Instruction ID: cf7d7078c9365913f55c3433b16b78ad5b1536bff22786c4c9e234c44f0f191f
Opcode Fuzzy Hash: c163452d9212d071307ac11b793e2936b65b18f0a8bd1f9c817cef19e19e0cca
Instruction Fuzzy Hash: 3AB16070E00229DFDF14CFA9C9857EEBBF2AF48314F148529D815A7294EBB4A945CF41

Function 04C259A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e08fe2e9d46910a880803e4688e7dd697b49f19368f07055ad66c6fadab2ed58
Instruction ID: bcb3b5de4d2ea5fe670d9ab6ec6483892209249e44d7fb7a4d36dc87a46b82be
Opcode Fuzzy Hash: e08fe2e9d46910a880803e4688e7dd697b49f19368f07055ad66c6fadab2ed58
Instruction Fuzzy Hash: E5B13F70E00219EFDB10CFA9D9857AEBBF2AF88314F148529D815E7254EBB4A945CB81

Function 04C25705 Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

\VMm, xrefs: 04C2577F
\VMm, xrefs: 04C258D8

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID: \VMm$\VMm
API String ID: 0-3689878465
Opcode ID: 2ed9a7cc06f105b1e14e60c348fa16217be0572aac9845ad417f3edfc51d3f64
Instruction ID: 474ecd1ccf3bf243b000974c419c229367752ff0041f0f4412baf6174a5f49bb
Opcode Fuzzy Hash: 2ed9a7cc06f105b1e14e60c348fa16217be0572aac9845ad417f3edfc51d3f64
Instruction Fuzzy Hash: 9D719F70E00229EFDB10DFA9D9407DEBBF2EF48714F148529D414AB254EBB4A942CF91

Function 04C25710 Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

\VMm, xrefs: 04C2577F
\VMm, xrefs: 04C258D8

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID: \VMm$\VMm
API String ID: 0-3689878465
Opcode ID: 05ceaba079999837fd50462afe2335aa24d94124e7c65cf1b2b391452619d6b3
Instruction ID: 7357f6e85b15e8c679098e1f5e19234557ba2b2b01ca468793ee964bab7c6918
Opcode Fuzzy Hash: 05ceaba079999837fd50462afe2335aa24d94124e7c65cf1b2b391452619d6b3
Instruction Fuzzy Hash: 27718DB0E00229EFDB10CFA9C9407DEBBF2EF48714F148429D414AB254EBB4A946CF91

Function 04C21630 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$^q, xrefs: 04C216CE
$^q, xrefs: 04C216DA

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 3102ca66a66925e9452d74a79c5f20317a3b9618e8dd009abf875e1f6cb9559b
Instruction ID: 0e7a635e3996ce8426c834be6817c71aaba594361cff4e8f32b3bb9600fc3bea
Opcode Fuzzy Hash: 3102ca66a66925e9452d74a79c5f20317a3b9618e8dd009abf875e1f6cb9559b
Instruction Fuzzy Hash: 5D51E335B002199FD714DF79D940AAEBBF6EFC9350B18802AE814D7364DE70AD42CB91

Function 04C250AD Relevance: 1.5, Strings: 1, Instructions: 279COMMON

Download Yara Rule

Strings

\VMm, xrefs: 04C25375

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID: \VMm
API String ID: 0-3195670953
Opcode ID: 1d74cf571b2d63e29bc9cfb970df2459ba5c3eba2589513f2056eb7e1467e6e1
Instruction ID: 24c8ea30ef9dde92ce24e62290e1d8b89dc9f3abe04227ff7363f6149309b3e2
Opcode Fuzzy Hash: 1d74cf571b2d63e29bc9cfb970df2459ba5c3eba2589513f2056eb7e1467e6e1
Instruction Fuzzy Hash: BDB13170E00229DFDB10CFA9D9857DEBBF2AF48314F148529D815A7294EBB4A945CF81

Function 04C21080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

(bq, xrefs: 04C211A8

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: c37c7f40d83c79a4e42ee49865488b79924f29ff79999cc092551b439ffc7bf6
Instruction ID: 6d772e2ebcc5bb44ca292b1940b0da6c09c7a93401b6c7b4b704a427bd941887
Opcode Fuzzy Hash: c37c7f40d83c79a4e42ee49865488b79924f29ff79999cc092551b439ffc7bf6
Instruction Fuzzy Hash: 5971D635B002249FDB149BB9C954A6EBBA7FFC8310F188025E506AB3A4DE71ED42DB51

Function 04C20C1C Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

(bq, xrefs: 04C218BF

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: e8ea71871c22e69d36b7217abbfdee1ff47e88f10db01f84ce40fe1f34c9ee92
Instruction ID: ca5153f5c170be2d742425b8fbadea90ecca541c5992b248662a71ced4471854
Opcode Fuzzy Hash: e8ea71871c22e69d36b7217abbfdee1ff47e88f10db01f84ce40fe1f34c9ee92
Instruction Fuzzy Hash: F63138307043645FF715AA3A49643AE7BE7DBC6304F19846AD502E73C6CDB8BC0687A1

Function 04C2599C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b835afc0c0f96c7e1da484ba41fbd5e5b1228ac0f45eb49ced3064f5866a1078
Instruction ID: 19d52d34ff809ba7f9fb02922892171654127c519aedc65f70778dfcdc588d90
Opcode Fuzzy Hash: b835afc0c0f96c7e1da484ba41fbd5e5b1228ac0f45eb49ced3064f5866a1078
Instruction Fuzzy Hash: 04B16F70E00229EFDB10CFA8D9857AEBBF2FF48314F148529D815E7254EBB4A945CB81

Function 04C21D58 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9229251846259f15bf6e6ec307f62079d6a16b447843e51313881ac8e769bd5
Instruction ID: 59ee0a74bf31357b49c0d4203858e15d64c82168ce56fcb33bb7b4a0ba71d796
Opcode Fuzzy Hash: a9229251846259f15bf6e6ec307f62079d6a16b447843e51313881ac8e769bd5
Instruction Fuzzy Hash: 17411734A04218AFD715DF64D824BAE7FB7EF89315F14406AD809D7390CE74AD85CBA1

Function 04C22268 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69c3dd579f2bade5e0c028fd41cebe507ed44253c920167cd182edc1e5d74c0
Instruction ID: 45323c8de9813b6664901fba0b4aeb2174a6d18001cb863659c41d17354692cd
Opcode Fuzzy Hash: b69c3dd579f2bade5e0c028fd41cebe507ed44253c920167cd182edc1e5d74c0
Instruction Fuzzy Hash: 24413C39B001149FCB14DFA9D98099EBBB6FF88714B10816AE905EB360DB31ED42CB91

Function 04C21071 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4471d4b813e76f7a7ebfbff5f4e3ab5058dc753114ff47a917689bba8875f0
Instruction ID: 98b28189889f3293956bea50615970c153de33d8a36f31bf9421787e4776b2b6
Opcode Fuzzy Hash: af4471d4b813e76f7a7ebfbff5f4e3ab5058dc753114ff47a917689bba8875f0
Instruction Fuzzy Hash: 82110036F0023497DB24CE558944AEF77EBDB84255F084036D907D7385DE74ED068B51

Function 04C20F20 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d15411bfe2de0b0938c6d1f3e9a18b5f6670f3108cf8f8e5c11f726ac99d1885
Instruction ID: 13af02b70a2f4574d045b048af222ec9269c7152c4524ab761aeebfd6faa4f94
Opcode Fuzzy Hash: d15411bfe2de0b0938c6d1f3e9a18b5f6670f3108cf8f8e5c11f726ac99d1885
Instruction Fuzzy Hash: CC01897AB093701BDB255B7A1A5462BAF9B9BC5260F098467EE08C7301EDE4EC0082F1

Function 04C22B18 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e4f0518d731eafd713fd297932af844a4db553ff55921630f28fb4e14ffa59
Instruction ID: 2bd514b7f6b64d351e736a6fe2be063e8b5fb884ff050640c981adb084e27875
Opcode Fuzzy Hash: 07e4f0518d731eafd713fd297932af844a4db553ff55921630f28fb4e14ffa59
Instruction Fuzzy Hash: E911E039B001294F8B94BBBD61206AE7AE3AFC4655B1044B9D40AD7384EF34DE029BD2

Function 04C22258 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128b2beedd7b324626d00ab8d30d7cb6e510b52df0db4866652cc8292d23770e
Instruction ID: 6d2a5da9643d7856ba1a8f6c2e323de68cbe1b6f8613d84d62f80576302d8153
Opcode Fuzzy Hash: 128b2beedd7b324626d00ab8d30d7cb6e510b52df0db4866652cc8292d23770e
Instruction Fuzzy Hash: 88213875A102189FCB54DF69D98499EBBB6FF8C710F10816AE919EB320DB31A841CF90

Function 04C21378 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597d06ce860319a148d1ee7eff6b945dcdb2254cc0dc81c67c76db2380f0a83f
Instruction ID: e4c79ff28c930f49f30de250462bbbcc3620eaa6dc6b175114bca1be5d91177c
Opcode Fuzzy Hash: 597d06ce860319a148d1ee7eff6b945dcdb2254cc0dc81c67c76db2380f0a83f
Instruction Fuzzy Hash: 812115B1D002498FDB14DFAAC5846DEFBF0FF48324F108029D559A7250CB746946CFA1

Function 04C21380 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e654e6107006eb90d2a76abd0f56e3214b181f3448971677763d959963141066
Instruction ID: 761f1aca41c7faebce679a9da19c89171816430502110191cd77581b162811df
Opcode Fuzzy Hash: e654e6107006eb90d2a76abd0f56e3214b181f3448971677763d959963141066
Instruction Fuzzy Hash: C911F4B5D042498FDB10DFAAC580ADEFBF4FF48324F108429D45967250CB74A945CFA5

Function 04C21968 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2ee5947e78232fdda20676d9e61922568e2997ff44f8c5be2795b083b589cc
Instruction ID: 2371e33f83efb2084ad2c17eb102bfada0005bd6a891a782256deb4ec3b220fe
Opcode Fuzzy Hash: da2ee5947e78232fdda20676d9e61922568e2997ff44f8c5be2795b083b589cc
Instruction Fuzzy Hash: 8A113D35600115BFDB14DFA8D858AAD7BB6EF8C312F14802AE40AA7794DF795C85CFA0

Function 04C22B08 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0c580ef2c86f40da7d27891544a59a0fd6f17a17bdc4a1ea3fc63c10b3e53a
Instruction ID: 2c274adec5dc71dccb6c65fa85aca673bd6aeb2cb5e367b683dc23baf943fac4
Opcode Fuzzy Hash: 7d0c580ef2c86f40da7d27891544a59a0fd6f17a17bdc4a1ea3fc63c10b3e53a
Instruction Fuzzy Hash: 9401C0387002258F8754AB79A1246AE7AE6AFC5645B0144B9D80BC7384EF3099029BE2

Function 04C21829 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c8d47ba0144a821556eb7e4b5f5aa1632454b9e81432109b33e492df553b3ee
Instruction ID: 0a73d63460572723625baa951ce39499d1a33b1cc081f20065a467be30123f70
Opcode Fuzzy Hash: 7c8d47ba0144a821556eb7e4b5f5aa1632454b9e81432109b33e492df553b3ee
Instruction Fuzzy Hash: FC01A231B0022597EB18A66986A57EF77E79B88718F15402ED102F3381CEF96D4297D1

Function 0497D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1754414602.000000000497D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0497D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_497d000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 870c4744b02c188bdf9e3608f7ae35e4269e2db46a1ba13a2b988481be1a4f2a
Instruction ID: 37ef8906fa038e95ad7769df6e0bd85b35f9f004b51b8c7092d36e9091e6a7b3
Opcode Fuzzy Hash: 870c4744b02c188bdf9e3608f7ae35e4269e2db46a1ba13a2b988481be1a4f2a
Instruction Fuzzy Hash: 77015E7100E3C09ED7128B259C94B56BFB8EF53224F1DC1DBD8888F1A7C2699849C772

Function 0497D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1754414602.000000000497D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0497D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_497d000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8db68239396470e621c35bd6d4af8398bf20c17500133a2f7e3f968b7748bc
Instruction ID: 4576e8a512aa428cdb99915685e84775f41b3c0e4ed2f4a98e692a3f5f50a00a
Opcode Fuzzy Hash: 5e8db68239396470e621c35bd6d4af8398bf20c17500133a2f7e3f968b7748bc
Instruction Fuzzy Hash: B9012670109300DAE7108F29ED84B67BF9CEF41324F08CA3AEC080B286C279E941CBB1

Function 04C22A68 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4962b63e6a78a401a314f25e91f64fdd56eb9f11a0bd81f9a9126b32bba8b4d8
Instruction ID: c76898dd2e685712076361890350bc6e5ffc8e37b7a2b554b50ae77fb9d771e8
Opcode Fuzzy Hash: 4962b63e6a78a401a314f25e91f64fdd56eb9f11a0bd81f9a9126b32bba8b4d8
Instruction Fuzzy Hash: FB014C39B10211DFC714AF75D505AAA3BF6EB89715F100079E90ADB360EB35A906CF81

Function 04C21440 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c69fbf1574a6a17231cda1bd10871baa1a14b67581e76ffe022a47b333ee04e
Instruction ID: 4ac7cf6ba40ed50797b7663af048cbd8c633856750e97c73dd83c74b01bad84d
Opcode Fuzzy Hash: 2c69fbf1574a6a17231cda1bd10871baa1a14b67581e76ffe022a47b333ee04e
Instruction Fuzzy Hash: 1E01F930A053451FDB0D9F34597511A3FEADED160430508EBC149CF561FD68D84B8BE2

Function 04C22997 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80db72c4fe9f7b1a1a896e1d5ce23127081ef40602cad7fd949b1e1fe4317bb
Instruction ID: b6de3af084402a2ad0e80404d0e94a1bedd9a37b60689709306c4bd8bbcbb611
Opcode Fuzzy Hash: b80db72c4fe9f7b1a1a896e1d5ce23127081ef40602cad7fd949b1e1fe4317bb
Instruction Fuzzy Hash: 1301F4312003109FE715ABB4DA05B993F66EF94215F0484B9E4028B691DFA1E8869BE4

Function 04C22A78 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2081c0e2073f2856b439c67cc3484704f6c09672e9a9d2832203c1723672d3
Instruction ID: 55d40b11ac0bc91822e754083816066c9a8a2d5b8579d17278132d4524990fea
Opcode Fuzzy Hash: 9d2081c0e2073f2856b439c67cc3484704f6c09672e9a9d2832203c1723672d3
Instruction Fuzzy Hash: 68016D39B00215CFC704EF78D406A6E3BF6EB89615B100079E509D7350EB719942CFC1

Function 04C21BB0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bce1e0fb948bdc1c1c00d44de2d238702ed7d8f466bd9dc31a5d6bc4a98e736
Instruction ID: eb492a108c97f78d51bc1be1213b4d79fbe23cb80b77bf6901454a21cbd08ee3
Opcode Fuzzy Hash: 6bce1e0fb948bdc1c1c00d44de2d238702ed7d8f466bd9dc31a5d6bc4a98e736
Instruction Fuzzy Hash: 5CF024397003202BD7311A16954472B7F5AAB81174F45002AEE098B241DFA0EC0186E4

Function 04C21431 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6423f03e0283e3cc3c2d92ef8a85b642a31d806f5d16fb875bd9bf2769aec751
Instruction ID: 5e10c3f469a793a5c0c9ddf9b43bac4648edfa1d68e3b2331384d7e736c1fab1
Opcode Fuzzy Hash: 6423f03e0283e3cc3c2d92ef8a85b642a31d806f5d16fb875bd9bf2769aec751
Instruction Fuzzy Hash: 54F0F634A002052FDB0CDE74553511A3BDAEAD160830508AAC10A8F151FD68E8468BE2

Function 04C229A8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0b41a620c015f67596e04343dcc85ebc98c81425fa741590a8c1587d363d5b
Instruction ID: d6b7dd510182e0adf325f7f15e45ebdc60f91f787a0177fdda40ae01ace236c8
Opcode Fuzzy Hash: 9a0b41a620c015f67596e04343dcc85ebc98c81425fa741590a8c1587d363d5b
Instruction Fuzzy Hash: B3F0E9313003109FE718ABB4DA05B5A3B56EF94305B048879F5069B794DFB1FC869BE4

Function 04C22A20 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca0c8a23ac11a0efa79812203f11c173c9e6167847985cc0cb78a4a79c61f72d
Instruction ID: 98d1df38adc70619404553a3d03b8266f3b9dc201c2079ebaed540145991185f
Opcode Fuzzy Hash: ca0c8a23ac11a0efa79812203f11c173c9e6167847985cc0cb78a4a79c61f72d
Instruction Fuzzy Hash: 5EE0D830706360CFE71616A265043BE3B9A9F65613F4640ABE80AC7191DB4C8D824365

Function 04C22A30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4429cc337639fe438edd29c7d84cceca28223e93054d9d34c4a5c3d7dd12c7
Instruction ID: 5d2dcec8126e968ef171e4849cd28ecea7afe2dc411cdde56d413e150f34c3a8
Opcode Fuzzy Hash: 1e4429cc337639fe438edd29c7d84cceca28223e93054d9d34c4a5c3d7dd12c7
Instruction Fuzzy Hash: 89D02B30301338DBDB1419B665042BE358DDB75A527410077F40BC3280DF8CDEC143A4

Function 04C25EB0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55375296b8f6f908c6027f51a5d2d9ec9940bccb1f11c72653e359defc8ea09e
Instruction ID: 15a3f13a601f29537e309e5f8d1bf4d9487f93278b125d053acd58c22caf0139
Opcode Fuzzy Hash: 55375296b8f6f908c6027f51a5d2d9ec9940bccb1f11c72653e359defc8ea09e
Instruction Fuzzy Hash: 41E02B322042104FD301872CE494BA53BA88F4AB2CF0200EBE10ACF363CA519C028799

Function 04C22959 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b31e4995a2b8fe309b6f248b3849b3115076cbd6c0d9cdb247acb0d61c81f27
Instruction ID: 2046322c4067d1b6ed61e5d94fb366ed3030dc05fd7d7f562647960bbda28db1
Opcode Fuzzy Hash: 7b31e4995a2b8fe309b6f248b3849b3115076cbd6c0d9cdb247acb0d61c81f27
Instruction Fuzzy Hash: E0E0DF748052089FCB00CFB4E801B4DBFF8EB82208F2146EAE454E72A1EB315D05CF80

Function 04C217F0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a452ec052fbde1b60db7fef29b939186a2d9786aa0d02b82c9fc4d83d96d8fbd
Instruction ID: bc72795a7466433e49e0e6d0fff78539ebe500a642127969386af3e184b572d3
Opcode Fuzzy Hash: a452ec052fbde1b60db7fef29b939186a2d9786aa0d02b82c9fc4d83d96d8fbd
Instruction Fuzzy Hash: 66E02B3B1081145FD3051B14F801AA57FA9971A220F0600A7F842873A2CE716C01DBE0

Function 04C20C48 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16dd7330dbd5e127dc257f4604407256c4db255e53e761ff1a8b2c6f3e5b7889
Instruction ID: fd01172bd47ca07dade5906206f2fba9d398bf70e3d53e0e50f7be881fe88305
Opcode Fuzzy Hash: 16dd7330dbd5e127dc257f4604407256c4db255e53e761ff1a8b2c6f3e5b7889
Instruction Fuzzy Hash: 6CD0A7313502205BD604935CD45497A7799DB89719B0044AAF60AC7360CD91FC000689

Function 04C20C0C Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2296849322c79e9154d267366f156bbcfae2095c89f973bb101a49cb4a51a6
Instruction ID: 9408afda588d7ea1e88bccb26bd26bec28fe7ec53b059af3087e60780807a6c7
Opcode Fuzzy Hash: 4a2296849322c79e9154d267366f156bbcfae2095c89f973bb101a49cb4a51a6
Instruction Fuzzy Hash: 74D0A7323100286B56046659D98597ABB9AE7953613148473FA0283364DDA0BC4097D5

Function 04C22968 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c67e0e0ec9558d9daa8277277e0c45b3c429f8400ec5508322c5c6c450dc746
Instruction ID: 381c498a8d1918530ff09f45036447729d02f347246b20cdddcc2cc18b623c77
Opcode Fuzzy Hash: 5c67e0e0ec9558d9daa8277277e0c45b3c429f8400ec5508322c5c6c450dc746
Instruction Fuzzy Hash: 3CD05E74901209DFCB04DFF5E942A5DBFF9EB44204B2086A6E408D3210EB305E05CBC0

Function 04C20440 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 451ee794cf5e74859a55e1edfe31430ad16204cfc0ea674f6b741f03fe5b492e
Instruction ID: 7a5359e7aad6bf8c7997463d1a64cbed9d966517ae8e72c0cbb0cda56b9e2312
Opcode Fuzzy Hash: 451ee794cf5e74859a55e1edfe31430ad16204cfc0ea674f6b741f03fe5b492e
Instruction Fuzzy Hash: 8AC02BF27949002FEF018A64CC1A6C9BFF0FE70318345807AE043C2023E22D1853DA30

Function 04C20E7C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.1753965674.0000000004C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4c20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df41202660afcf02d3cc4b0a1826b86883d47c6a56ce3b00cc0d486a7f5253d
Instruction ID: 9a863f6aa6004db6e51c4bf649d8b894f079d0775256da1f91f81c4ecd24b271
Opcode Fuzzy Hash: 1df41202660afcf02d3cc4b0a1826b86883d47c6a56ce3b00cc0d486a7f5253d
Instruction Fuzzy Hash: 8DB01287684010167500A7374AD4476C4D3E6C0204BCCCC511102E001D5D64F0012005

Analysis Process: AteraAgent.exePID: 7916, Parent PID: 7368COMMON

Executed Functions

Function 00007FFD9B380C1D Relevance: 1.2, Instructions: 1196COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb2e2b5e08a06dbc2e1bb5325f8833e758b04a0fa0eacb5e7d862c45bd92de4
Instruction ID: aed2b285151bdaa15b675f815ee9dc22fe7bfa9491e934938d2ac5bde10b1b93
Opcode Fuzzy Hash: 7eb2e2b5e08a06dbc2e1bb5325f8833e758b04a0fa0eacb5e7d862c45bd92de4
Instruction Fuzzy Hash: 32A23B70A09A1D8FDBA9EB54C8A4BA8B3B1FF59305F5040FDD01ED7295CA35AA81CF11

Function 00007FFD9B38187E Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92d328739e9a45259988ec572c475b08c30695ab9cea032a8a9011181f364c6
Instruction ID: 8a2ff503ccd1e65d80ba34f6242cddce86ac125f3409f911528d91349a1f969e
Opcode Fuzzy Hash: a92d328739e9a45259988ec572c475b08c30695ab9cea032a8a9011181f364c6
Instruction Fuzzy Hash: 5B322B30E09A1D8FDBA9EF68C8947A9B7B1EF59300F5140E9D00DE72A5CB756A85CF01

Function 00007FFD9B38C922 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a5340a846739f127a30735832d53cdfc23e680fa554f755658c68e9859c203
Instruction ID: 404ddfee7d66e8edaf529fb244ca6eed9453675a8051d428026b88bd3a548220
Opcode Fuzzy Hash: 71a5340a846739f127a30735832d53cdfc23e680fa554f755658c68e9859c203
Instruction Fuzzy Hash: B8E1D330A09E4D8FEBA8EF68C8657E977E1FF54310F44426ED84DC72A1CE7899458782

Function 00007FFD9B381E7E Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca4685c365bf4031546a4f2e826aa1c8c1843f731d82c4edfb634cc6ae44e72
Instruction ID: b9c8c218add99d835fc53fa5e3b7cecaba52ac8090d3b57f3dbaa12e1dfc431c
Opcode Fuzzy Hash: aca4685c365bf4031546a4f2e826aa1c8c1843f731d82c4edfb634cc6ae44e72
Instruction Fuzzy Hash: 44512D30E09A2D8FDBB5EFA888947A9B3B1EF59300F5144E9D00DD72A1CA356E81CF01

Function 00007FFD9B381E88 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735e09778d9e63f455cdf69fe4de8c338085c00da7abffe6edcab672d3ea3f0f
Instruction ID: 08beaba6d91db803d3a9cdc4b65beda324d43276bd4fd8450b7c525b03133ca6
Opcode Fuzzy Hash: 735e09778d9e63f455cdf69fe4de8c338085c00da7abffe6edcab672d3ea3f0f
Instruction Fuzzy Hash: 90413B30E09A1D8FDBB5EBA8C8A57A9B3B1EF59300F1140F9D00CD72A1CA756EC58B41

Function 00007FFD9B381EB6 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405f39523a2484f963034d7fc17d935868d3d56f2cc20d1f528e18605dadb906
Instruction ID: f30bdb0dcb47177f3f4bed45addd3c6d9e7103934cd2a2f706a259f4bd16aea5
Opcode Fuzzy Hash: 405f39523a2484f963034d7fc17d935868d3d56f2cc20d1f528e18605dadb906
Instruction Fuzzy Hash: 42410970909A2D8FDBA5EF6888947A9B7B0EF59700F5145E9D00DD32A1CA356EC1CF01

Function 00007FFD9B387627 Relevance: 1.7, Strings: 1, Instructions: 479COMMON

Download Yara Rule

Strings

E, xrefs: 00007FFD9B3879AA

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 7ca165fd72135deee15159d3d0d74beb68beffec59b2123fb86e22a46ba113af
Instruction ID: 4a08cab041dda72f0198ab4d6c42f44bda54cc1ea08fea8b78fd1b7b77765360
Opcode Fuzzy Hash: 7ca165fd72135deee15159d3d0d74beb68beffec59b2123fb86e22a46ba113af
Instruction Fuzzy Hash: AD812921A0EE8D8EE755EBBC98256E87BA1EF5A340F1402FBC448C71F7DE252941C352

Function 00007FFD9B388265 Relevance: 1.7, Strings: 1, Instructions: 475COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFD9B3882C9

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 83ac67021ae4db78f3f7fdd154fc515c56b3b6e7a60bd9c592d4c76b05910036
Instruction ID: 71f9724b5029400b0ba51d87d0c49deda67952fab7a0a0bf64cd200f84b199e6
Opcode Fuzzy Hash: 83ac67021ae4db78f3f7fdd154fc515c56b3b6e7a60bd9c592d4c76b05910036
Instruction Fuzzy Hash: FF020D70A09A1D8FDBA4EF68C464BA8B7F1FF19301F1541AAD04DE72A1DB35A985CF01

Function 00007FFD9B38596C Relevance: 1.7, Strings: 1, Instructions: 406COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD9B385C01

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID: M_^
API String ID: 0-3807191693
Opcode ID: 7e0290a0efa833fe80a480f436f4478be77e7106cf8b1d5b5a686fc5aa25a750
Instruction ID: 51a8178a626fd7a6971f5635326730af660807ed76f3dc4efe2f80356b1f49ff
Opcode Fuzzy Hash: 7e0290a0efa833fe80a480f436f4478be77e7106cf8b1d5b5a686fc5aa25a750
Instruction Fuzzy Hash: 9DC15E22B0FA4A4FE325FBB898611E877B0EF52321B4502FFC049CB5E3E92955458392

Function 00007FFD9B470853 Relevance: 1.0, Instructions: 953COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826563010.00007FFD9B470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b470000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e69ea49b03f23bd657befa9709e979130152f078f51f76f0a1d913cbb4acd94
Instruction ID: 5a157fd9d15272291eeb3d5e6de837ade75502133108c533ddebf84c71b39ff0
Opcode Fuzzy Hash: 7e69ea49b03f23bd657befa9709e979130152f078f51f76f0a1d913cbb4acd94
Instruction Fuzzy Hash: E4F12620B0EA494FDBA9972C98656347BD1EF9A714B0502FFD08EC72E3DD24AC02C781

Function 00007FFD9B380C89 Relevance: .9, Instructions: 922COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d49de7a90954936922b53e3b8a63765f84ba91a8e37457a3d979c632620515
Instruction ID: 11623d1b106b168e94cd6aa818d6015e8c7b36b0424c610bd9f7abe7adf2eda4
Opcode Fuzzy Hash: d8d49de7a90954936922b53e3b8a63765f84ba91a8e37457a3d979c632620515
Instruction Fuzzy Hash: D5824C70A09A1D8FDBA9EB54C8A4BA8B3B1FF58305F5040FDD01ED7295DA35AA81CF11

Function 00007FFD9B38B679 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47c2052412e83cf11897c1fc7b174c46ec20d84f9ecfd3af14c63c0740ae0e5b
Instruction ID: 39a048c8ddcec9ca1d68064f2298c0d6cb717be44dd08606f10b8ce9c34f2c56
Opcode Fuzzy Hash: 47c2052412e83cf11897c1fc7b174c46ec20d84f9ecfd3af14c63c0740ae0e5b
Instruction Fuzzy Hash: 21D1E930A0CA8D8FEB68EF68C8557E937D1FF58300F04426EE84DC7291DB75A9458B82

Function 00007FFD9B38673A Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae5f95fe12b6b48398fec13a82521364f1170e19e3d88092bc0994154953a7b
Instruction ID: 49039897626bbe18fb967642fa3c7663380a7240fa890626e06e23178e6f31c3
Opcode Fuzzy Hash: cae5f95fe12b6b48398fec13a82521364f1170e19e3d88092bc0994154953a7b
Instruction Fuzzy Hash: BED14F71A0EE8E4FE765EBA888659653BE0EF15300F0541FED44DCB1E7E938A9058782

Function 00007FFD9B382FFA Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d2e7a17b0e6d2b17ffc193abac034e5c41fdd916a6ba6279ae067f7ccef291
Instruction ID: 0c3c8cb83f869e9d30922163225b10b4adc4b2b02bfa1caa72ccf7350f70a7cf
Opcode Fuzzy Hash: 83d2e7a17b0e6d2b17ffc193abac034e5c41fdd916a6ba6279ae067f7ccef291
Instruction Fuzzy Hash: 52B12953B0E5A54AE311B7BCB8726ED7B60EF42339B4841B7D1DD8E2D7DC28244A8391

Function 00007FFD9B38C536 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e5f9563bfe19fdcb21a55c584ab0f9f34a3c4d555520f79d6929e674a1fccd
Instruction ID: a6c60372e185660791c5271a33b55e83d421cf468d3fea567f716fd8a42e9e42
Opcode Fuzzy Hash: e3e5f9563bfe19fdcb21a55c584ab0f9f34a3c4d555520f79d6929e674a1fccd
Instruction Fuzzy Hash: 65B1C43060DA8D4FEB68EF68C8557E93BE1FF55310F44426EE84DC7292CB74A9458B82

Function 00007FFD9B470040 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826563010.00007FFD9B470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b470000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f340325bac484c039b63dfc8ca48ab99aceab74b73f985154305a2ca5cf42605
Instruction ID: 45cab10a9f723cd5a72072b456f389ee1abace15b009b0cdaa49b28351f9c1a2
Opcode Fuzzy Hash: f340325bac484c039b63dfc8ca48ab99aceab74b73f985154305a2ca5cf42605
Instruction Fuzzy Hash: BC91F77170EB884FDB69DB6C98A55747BE1EF5A714B0601FBD08AC72A7CD14AC02C341

Function 00007FFD9B38D7BE Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 826370a985fe42b2ae11cba0eaf289ffdbc1d94091390695aab7f32be1227884
Instruction ID: 847674c8bff1c89bd80a74db3ac35d621a1628c1751d4a2018d59ac3e0f04733
Opcode Fuzzy Hash: 826370a985fe42b2ae11cba0eaf289ffdbc1d94091390695aab7f32be1227884
Instruction Fuzzy Hash: 8AB1C570A08A5D8FDF94EF58C894BA8B7F1FF69301F1141AAD00DE7261DB74A981CB41

Function 00007FFD9B383368 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 108a90540cec571e8fae4da562e04bc1eb8234b13bb93095f84031006b1f8674
Instruction ID: 8e02f14440fb0b863a10cd298602caf18a2dd5782e5e9ac4c7842a24c09f04f7
Opcode Fuzzy Hash: 108a90540cec571e8fae4da562e04bc1eb8234b13bb93095f84031006b1f8674
Instruction Fuzzy Hash: A9B18130A0DA5D8FDBA5EBA8C4607A9B7B1FF59300F1141BED00DE72A1CB356A85CB01

Function 00007FFD9B381B2F Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855b2c2e4eff3e37a11dcf3843a3bce3cc7037bf1f614c4bb2f43d0b826344c1
Instruction ID: f54e31f0ba60e6e3c2d115b6cc352c07b095bf14ab1d7e176a4d2ce3ba78df50
Opcode Fuzzy Hash: 855b2c2e4eff3e37a11dcf3843a3bce3cc7037bf1f614c4bb2f43d0b826344c1
Instruction Fuzzy Hash: 9AA12A30A09A2C8FDB65EF68C8947A8B7B1EF59300F5040E9D04DE72A5CA75AE84DF41

Function 00007FFD9B38946C Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5acae4dddaebe9c50d969214d9f36819788925039d8503bdf3027075033d2e
Instruction ID: 4231f6ec0f5cda473209adaaeb230e30708031c9e3eaded506f4f42fc4c3fee3
Opcode Fuzzy Hash: bd5acae4dddaebe9c50d969214d9f36819788925039d8503bdf3027075033d2e
Instruction Fuzzy Hash: 0C517231918A0C8FDB68DF58D855BE9BBF1FF59310F0082AAD44DD3292CE34A9858B81

Function 00007FFD9B4704DE Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826563010.00007FFD9B470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b470000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09743ded47cdca8792df8be87023c6d16853158dbfcc887dd537cdf62980e07
Instruction ID: c5cc16db7148d39ed02dbb851268e5fe131212cf1c5ea7c1150dced78ea914a0
Opcode Fuzzy Hash: e09743ded47cdca8792df8be87023c6d16853158dbfcc887dd537cdf62980e07
Instruction Fuzzy Hash: 96410322B0FB894FE792DB7C48AA5603BE1EF6A61431901FBD089C72B7D914AC46D341

Function 00007FFD9B3863FB Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa43f9a2fe27a1ca63250ef876ec2c3681c147282913196fe402822ff8552d15
Instruction ID: 058088579667916e5f0c04f702cd1fd328f25bf8afce9a91c4c47f4f0ca7a200
Opcode Fuzzy Hash: fa43f9a2fe27a1ca63250ef876ec2c3681c147282913196fe402822ff8552d15
Instruction Fuzzy Hash: 8F411721B0EE8E4FEB91EFA8D8605E937A0FF55310B1142BAD45DC71A6DE35AD02C742

Function 00007FFD9B38E6D9 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eefbcb5549cd09d337e325c9ddda4c62819442453251ae8a13893d88d4079f10
Instruction ID: 85e00efc217219395e63c9da68f91c0c22b9b21ed15fa96efac521e77e905f30
Opcode Fuzzy Hash: eefbcb5549cd09d337e325c9ddda4c62819442453251ae8a13893d88d4079f10
Instruction Fuzzy Hash: 55411A34A0991D8FDB58EF98D8A0AFEB7B1FF59300F15046DE00AE72A1CB35A940CB55

Function 00007FFD9B387A45 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d3c018c52614fe18abc7e3bdc4d89494ad8065122b6cde20620e5e7890894c
Instruction ID: 3c204692bb51958b754992a62bc7d444520386d4e075986dcd32898dd6222145
Opcode Fuzzy Hash: 54d3c018c52614fe18abc7e3bdc4d89494ad8065122b6cde20620e5e7890894c
Instruction Fuzzy Hash: A3416430D0DA4DCFDB55DFA8C4606E97BF1FF59300F1500AAD408DB2A1DA39AA45CB51

Function 00007FFD9B38D1F5 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa24e81eb6a0cbf26cd567f7a3f9d13ebf3f1f605d34e8b8f63b0a2aa38073a
Instruction ID: 913042979f1707a6d65c93cd83abacb1da2128cd174e8fe3fec0484b530ed870
Opcode Fuzzy Hash: 4aa24e81eb6a0cbf26cd567f7a3f9d13ebf3f1f605d34e8b8f63b0a2aa38073a
Instruction Fuzzy Hash: FE41E530E19A0DDFDB94EBA8C465AACB7B1FF59300F5100BDD409EB2A5DB39A941CB01

Function 00007FFD9B3882F8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4b66081de0876bcff026e421faada704e2ac6bcb7e2d322d83a8201e8013a
Instruction ID: cf8ef3bdc1a256a17308104c74772c6776794d870c8b45e4cab9716c12bfc4cb
Opcode Fuzzy Hash: 33e4b66081de0876bcff026e421faada704e2ac6bcb7e2d322d83a8201e8013a
Instruction Fuzzy Hash: 67312F74A09A4CCFDBA4EBA8C4607A8B7B1FF59301F5141AED10DE72A1DB356A85CB01

Function 00007FFD9B387C51 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341543f420b9b540d9e17c5da6ea83804ee1581db2649152a0dc7984fa4f0152
Instruction ID: 8ab05df4cc1ccea776a4659f64f0ed081b81c533b9cb36ffda34595ecbf30315
Opcode Fuzzy Hash: 341543f420b9b540d9e17c5da6ea83804ee1581db2649152a0dc7984fa4f0152
Instruction Fuzzy Hash: C231C430A0DB4CCFDB51DFA8C850AA97BF1FF5A300F1441AAD408DB2A2DB35AA45CB51

Function 00007FFD9B384EFA Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ea9b3a949567e443011392c1bde10010d97270b8e08f02fe7d0b37dd43008e
Instruction ID: a009e491943a16753e34549e59dc2b3c12dee6d691da7b087ce5202a21da35be
Opcode Fuzzy Hash: a6ea9b3a949567e443011392c1bde10010d97270b8e08f02fe7d0b37dd43008e
Instruction Fuzzy Hash: 2921E532A0EA9D0FD715EFA8A8615DA7BA0FF45310B0503BFD459C72A3CD745906C391

Function 00007FFD9B387DC1 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5f7c1464d48819f2fd0cb85e3a2d6884f65ef2c42816a3a9d5c384d2cebe85c
Instruction ID: 800301854ca19d64e1037912ef720c9e3391bf869ffb43946897a595e74eb4df
Opcode Fuzzy Hash: b5f7c1464d48819f2fd0cb85e3a2d6884f65ef2c42816a3a9d5c384d2cebe85c
Instruction Fuzzy Hash: E4215E30E19A0D9FEB94EFA8C855AEDBBF1FF59314F01007AD408E72A1DB34A9448B41

Function 00007FFD9B38483D Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87acead990fe5fc3c48b8caba1cfbde00faa0c7fb21c30f55687a0ec8d455daa
Instruction ID: 489419155726a123ac0002621cbe433c749fe0d2e08aa160bbdbf38ed3fb8331
Opcode Fuzzy Hash: 87acead990fe5fc3c48b8caba1cfbde00faa0c7fb21c30f55687a0ec8d455daa
Instruction Fuzzy Hash: 4E110A22A0A9DD0BE720FFA8A8B11F93B50FF02214F0506BAD458871E3DD3969458241

Function 00007FFD9B3849F1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6a427ed7ec7006e50d887513a4601ea11fa9218c8aff573c62f88b86001022
Instruction ID: a30955b99d862b8bb1176a2a2fa9747e065a2133e56fd417581787d5584c3a8e
Opcode Fuzzy Hash: 0e6a427ed7ec7006e50d887513a4601ea11fa9218c8aff573c62f88b86001022
Instruction Fuzzy Hash: A811D03420AA4DCFD795EF68C460A9577A2FF4A304FA244BDD41DCB2A6CE37A946C701

Function 00007FFD9B383B7D Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b883f252febed65a0278a87497d366528f0bdc562d965406cb433e091e0e0f59
Instruction ID: a594cb22f32d0c85ad98caee7152bd5818204440b5ef6d45cac1a7fc6875ac0f
Opcode Fuzzy Hash: b883f252febed65a0278a87497d366528f0bdc562d965406cb433e091e0e0f59
Instruction Fuzzy Hash: 4E11C271E0DA0D8FDB15EBA4C4256EDB7B1EF46310F4101B9E109D72E2DF7869448B41

Function 00007FFD9B38D12B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc38f4a8ddcff7856a7db43ced727419f9bc10dad46c0f96ba48cf6c4e6a768
Instruction ID: 33a30bc2c6726b0a8c52d2e5749aca3c0492dc2baa6d1c2a5181344c0678461b
Opcode Fuzzy Hash: 9fc38f4a8ddcff7856a7db43ced727419f9bc10dad46c0f96ba48cf6c4e6a768
Instruction Fuzzy Hash: AC11B330A1991DDFDF94EFA8D494AECBBF1FF59311F5500AAE009E7261CA35A841CB10

Function 00007FFD9B386E93 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1826077077.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b380000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db7e997fc44cbe5bcde5953b4116c764836bf346ba6dd5c1a6b7f147ab74357
Instruction ID: af91e5e859fca0968326cecb29c376e92892aaef3044664b044beac725cb2127
Opcode Fuzzy Hash: 4db7e997fc44cbe5bcde5953b4116c764836bf346ba6dd5c1a6b7f147ab74357
Instruction Fuzzy Hash: B1A00282BCF86E01D45470DD78660D8B244C785171BC66576ED1C9815A98AE1AD6128A

Analysis Process: AteraAgent.exePID: 8100, Parent PID: 620COMMON

Executed Functions

Function 00007FFD9B589E9D Relevance: 1.2, Instructions: 1153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 670e0b8aa95d888aa760ee835598271e8a6a042bb773c41dd8263f91d8abf820
Instruction ID: e6e32cada082a587f90aa063abea3ade5dd4d152e06f4d2660befa9a7fba09da
Opcode Fuzzy Hash: 670e0b8aa95d888aa760ee835598271e8a6a042bb773c41dd8263f91d8abf820
Instruction Fuzzy Hash: A3828F31719E4D4FEBE9EB6C8468BA577D2EF98300F4540BAE04EC72A7DE64AC418741

Function 00007FFD9B374E6B Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59d7c05b880c10798573112ed6beb8ec926708a1c22ab791b34309a1504cb01c
Instruction ID: 7be2a32f0b969d07323722c3d4ce79dea108afee1397e58bd5cedaf6b55b84df
Opcode Fuzzy Hash: 59d7c05b880c10798573112ed6beb8ec926708a1c22ab791b34309a1504cb01c
Instruction Fuzzy Hash: 9F41D331E0A65E8FDB69EFA884A46EDBBF1EF45310F0540BDD008D72E2DA385945CB90

Function 00007FFD9B581A1C Relevance: 3.6, Strings: 2, Instructions: 1055COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B581DDB
_, xrefs: 00007FFD9B582031

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID: H$_
API String ID: 0-2348066985
Opcode ID: 525175cc78ed6623e63159093650cc59ca355438d881298792e0a7322be1f22f
Instruction ID: c7a487032a8bc7d44ddee04c9fa8be360c618341f2d9b7deb21ead47a9e2e5eb
Opcode Fuzzy Hash: 525175cc78ed6623e63159093650cc59ca355438d881298792e0a7322be1f22f
Instruction Fuzzy Hash: 3C72F730B09A4E4FEBA9DBA88465A7577E2EF58344F5040BDD04EC71A7DE35AD41C740

Function 00007FFD9B58028D Relevance: 2.5, Strings: 1, Instructions: 1269COMMON

Download Yara Rule

Strings

A._^, xrefs: 00007FFD9B580301

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID: A._^
API String ID: 0-2177873606
Opcode ID: 4e23b35b2bc02db71a98305c0ac3729e0b981b96e27fc643c918693d011e8a34
Instruction ID: 52b94bd9b13da2c91a408b93164c75714297636dfea645b502769eb4277d7b25
Opcode Fuzzy Hash: 4e23b35b2bc02db71a98305c0ac3729e0b981b96e27fc643c918693d011e8a34
Instruction Fuzzy Hash: 9F822831B1DF894FE7A5EB6C84A5AAA77E0FF54710F4901BAD089C72A3DE34E8418741

Function 00007FFD9B383B18 Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFD9B3847FE

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: b700c95783fc10aac9da190656d7bd222060f709b3a8ce4f8a834113e58cbcf8
Instruction ID: 12b5c5254f9444dc2f74be041b1e87d3c4057251e31dd843d938d47d6c95b484
Opcode Fuzzy Hash: b700c95783fc10aac9da190656d7bd222060f709b3a8ce4f8a834113e58cbcf8
Instruction Fuzzy Hash: 43D11430B1CF494FD328EB98E4915B5B3E0FF95314B14457ED09AC36A6DA35F8428782

Function 00007FFD9B38447A Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFD9B3847FE

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: eb6676ff7efe17af90bc67b1188212ab4d64962c2e65deb94c44702708aefe12
Instruction ID: e67bbd7ecdfe976e55d238f5d5390b7217bae7be87ef814b27c3263825cf9fb5
Opcode Fuzzy Hash: eb6676ff7efe17af90bc67b1188212ab4d64962c2e65deb94c44702708aefe12
Instruction Fuzzy Hash: 74C12330B1DF894FE769EB988460575B7E1FF99300B1505BED08AC36A6DA35F842C782

Function 00007FFD9B37A01D Relevance: 1.6, Strings: 1, Instructions: 394COMMON

Download Yara Rule

Strings

'T_L, xrefs: 00007FFD9B387C0F

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID: 'T_L
API String ID: 0-895320791
Opcode ID: 37d32df0724eba7c2d172baea3cabb3d587eabd0e876413f1b0e44d99e89e7fa
Instruction ID: 11ba233880435aa44f10a10e5be398eddabe804e26066c39105ea82b27e46b09
Opcode Fuzzy Hash: 37d32df0724eba7c2d172baea3cabb3d587eabd0e876413f1b0e44d99e89e7fa
Instruction Fuzzy Hash: 48B14821B1DE4D4FE7A4FA6C98696B977D2EFD836170101BFD04DC72A2ED24AC468381

Function 00007FFD9B3803C5 Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFD9B38062E

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 62bbe73e98499302f422cf9061765ef94e57de475c6a7e8207ecc74d30d6185c
Instruction ID: fffc5a9a2f7f6d53eba62f8578b3403e3d4190a2b3c896c267ab12f36d2be1f3
Opcode Fuzzy Hash: 62bbe73e98499302f422cf9061765ef94e57de475c6a7e8207ecc74d30d6185c
Instruction Fuzzy Hash: 98B1EF3071CF098FD768EB48D4A1575B3E1FF98710B144A7DD49A836A6DA35F8438B82

Function 00007FFD9B5801D8 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

%+_H, xrefs: 00007FFD9B5AFF72

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID: %+_H
API String ID: 0-3348406568
Opcode ID: ad173c48a1d23a6ee1a500b1e2af45fe0e3881f690369d3567488d2675f98fd1
Instruction ID: 1e88448982e1e738129eb084d67038e1166257d97e6a0fd2c8845d080315781e
Opcode Fuzzy Hash: ad173c48a1d23a6ee1a500b1e2af45fe0e3881f690369d3567488d2675f98fd1
Instruction Fuzzy Hash: 0F817831F0DA5E0FEBEAAB6884656B977D1EF65310F08007AD44DC71D7ED28AD428781

Function 00007FFD9B5803F2 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

@._^, xrefs: 00007FFD9B580401

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID: @._^
API String ID: 0-963891619
Opcode ID: 6a6f7e2f3604b14e8e4762bcc38f7afb82135ff1edd6b87e8bbed7ddfa2d736b
Instruction ID: a36a2a8647b2534e98fbd3f9d4a777d72e651834a40f222410d7f3e0351dfc4e
Opcode Fuzzy Hash: 6a6f7e2f3604b14e8e4762bcc38f7afb82135ff1edd6b87e8bbed7ddfa2d736b
Instruction Fuzzy Hash: 10913431A1DF894FE7A5EB6C84656A67BE0FF58710F49017ED08DC72A3DE34A8418740

Function 00007FFD9B37D0C0 Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

^N_^, xrefs: 00007FFD9B37E601

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID: ^N_^
API String ID: 0-3244440111
Opcode ID: 3d0ca55630cb51c21ebe0ced2145c31cfdac6076d5d847c4f0ee98615dd4d5aa
Instruction ID: fe09ff9c323d6a13f6a474fa605317beb84a637f1da200f035f6e00b2cc65548
Opcode Fuzzy Hash: 3d0ca55630cb51c21ebe0ced2145c31cfdac6076d5d847c4f0ee98615dd4d5aa
Instruction Fuzzy Hash: 5D51A362A1D7A54FD302A778A8B62D83BA0EF4333574941F7C189CF1E7E9582C46C396

Function 00007FFD9B5800F2 Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

%+_H, xrefs: 00007FFD9B5AFF72

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID: %+_H
API String ID: 0-3348406568
Opcode ID: 7030ddf3a9047836ec1f2cb6cbb15c2425cbc0fa09c77be17b8e2b2aad4767fc
Instruction ID: 5669c43d1c51754558f1a7f1ee852029095094ab5b61dd7e7c227c097f4894ce
Opcode Fuzzy Hash: 7030ddf3a9047836ec1f2cb6cbb15c2425cbc0fa09c77be17b8e2b2aad4767fc
Instruction Fuzzy Hash: 68510B66B1E2960AF355B77CB4A26E93780EF42339B0842B7E09DCF1E7DC1868854394

Function 00007FFD9B37813C Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

X, xrefs: 00007FFD9B37813C

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID: X
API String ID: 0-3081909835
Opcode ID: 850933f24f86ae921a307bfcfc5cefe3d38ea425fc093daceb296034b800b568
Instruction ID: 5ed0e9b914048291690ce4b5b797a67d649dadeff9be57eb7df35801cea3ca9c
Opcode Fuzzy Hash: 850933f24f86ae921a307bfcfc5cefe3d38ea425fc093daceb296034b800b568
Instruction Fuzzy Hash: A1611A71E0961D8FDB64EBA9C8A47EDB7B0EF05311F5001BED009A72A1DB385985CB51

Function 00007FFD9B379E95 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

+%, xrefs: 00007FFD9B379ECE

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID: +%
API String ID: 0-3645226418
Opcode ID: 9339681432e984eda8962001c3a36e05143a57ad19fb1a668816bd2f04e8e000
Instruction ID: fe035c93de2b154f0157556904286e851d28e1b1de6398308086827ef4bc7e47
Opcode Fuzzy Hash: 9339681432e984eda8962001c3a36e05143a57ad19fb1a668816bd2f04e8e000
Instruction Fuzzy Hash: 86E04F52A0EACA1FE766E26809FD0641B91DAA216030A02ABC488C75A3EC4959468352

Function 00007FFD9B37CFC8 Relevance: .7, Instructions: 695COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc58d92dbe9443f6784bf8d92b26d0f9a0be9e3b336553d6435ad76d1170df8c
Instruction ID: 14743f67a0003a12a94534dc24355a8cb2d7c614ded082de1352cb8db4ce3af8
Opcode Fuzzy Hash: dc58d92dbe9443f6784bf8d92b26d0f9a0be9e3b336553d6435ad76d1170df8c
Instruction Fuzzy Hash: 1322F430B2DB4D4FD769EAAC84A167A77E1EF85700F15417DE4CAC31A6DA38EC428742

Function 00007FFD9B584970 Relevance: .7, Instructions: 661COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8bb6b4ea932947816ae364e535ff0325c47881185e742de379e8f4d5e5a0e5
Instruction ID: 7302db72dc8ec6b50708e56c7041fa7a0258ed26704078c80f6018e72061500f
Opcode Fuzzy Hash: ff8bb6b4ea932947816ae364e535ff0325c47881185e742de379e8f4d5e5a0e5
Instruction Fuzzy Hash: 40120461B1EE4E0BEBA9EB6C446557577D2EF94340F8001BDE45AC32F7EE64BD018280

Function 00007FFD9B37AB08 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88aebcc1ba729bc36b19f098eeed1f8ac946ca97e41f36d601e3a07ba7e6459
Instruction ID: cdfb3504713099d862bc26855f567afa510b3f813f76e0b36dcc218ff17313be
Opcode Fuzzy Hash: a88aebcc1ba729bc36b19f098eeed1f8ac946ca97e41f36d601e3a07ba7e6459
Instruction Fuzzy Hash: 6CF10821B1EA4E4FEBA9EB6C54B567437E1EF99310B4500BEE44DC72E3ED24AD068341

Function 00007FFD9B383235 Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8937ac67a33afadd80aa029d9b63c5b771faf3f77982b3f5875b7a4ec58ec73d
Instruction ID: 06ae6ff6d25b76ab09f1f251b0bcc815196e7c4bd3e9a4cef9be97bd61b58c1c
Opcode Fuzzy Hash: 8937ac67a33afadd80aa029d9b63c5b771faf3f77982b3f5875b7a4ec58ec73d
Instruction Fuzzy Hash: A3022A52B0FAD50BF765B7EC68765E97FA0EF4236470801FBD0988B2E7DC2469068381

Function 00007FFD9B37DE20 Relevance: .5, Instructions: 537COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba61027a1f46b8ad692d79d17c4385bcd4695dbd2f165b6853f59caf5e80b1b
Instruction ID: a1d3db7fb54a61e95a205c9475f306329845e8732c3bd4269c21df85e50377a7
Opcode Fuzzy Hash: 0ba61027a1f46b8ad692d79d17c4385bcd4695dbd2f165b6853f59caf5e80b1b
Instruction Fuzzy Hash: F0E18D71B1DA494FE759EB6C84A55757BE1EF99350B0001BEE08EC72E7EE24EC428381

Function 00007FFD9B37A7FA Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c10553957b2639fc59f550aa9a2d666e97f74414fd336fec28c8d6647eabc0
Instruction ID: 074373303a89505ba75b6c99be792da8790a6f03712e6ecec943d4993d16d727
Opcode Fuzzy Hash: 27c10553957b2639fc59f550aa9a2d666e97f74414fd336fec28c8d6647eabc0
Instruction Fuzzy Hash: 04E13952B1F69D1BF361B6EC68B16F86BA0EF427B470902FFD198871E7DC0869064381

Function 00007FFD9B381DB2 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe896128f766f76dccdaa9d6a357bc9dbe674d62a4a6443bc30c7c0159f0f4b4
Instruction ID: ffab0bfe8f2e9380695e520c021d39a7b704ac444827840c9196cc9a2adeb960
Opcode Fuzzy Hash: fe896128f766f76dccdaa9d6a357bc9dbe674d62a4a6443bc30c7c0159f0f4b4
Instruction Fuzzy Hash: 50F1B17071CB494FD769EBA9C4A166AB7E1FF99300F04457DE48AC3291DA34F941CB82

Function 00007FFD9B37D9E9 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab7e364c44a87160f392f3f8d5134e0319c198232639c05cc9db4857b8c4b77
Instruction ID: 57c8b80b0c07c053db1b2368f4aa0f90df248ebb72c9c2819de7c74cba953241
Opcode Fuzzy Hash: 9ab7e364c44a87160f392f3f8d5134e0319c198232639c05cc9db4857b8c4b77
Instruction Fuzzy Hash: C6D1537160DB4D4FDB64EA58D495AA1B7E0EFA6310F04027ED08DC72A2DE22A846C782

Function 00007FFD9B3833D3 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90118382d1207f62fa602fb3431377c4f597cbb4481ed1cb5e07ccb8c4c245df
Instruction ID: 0f23933c6a84b34c1199606263e25f7043373a8215fcf0555b3b8691c41d3f53
Opcode Fuzzy Hash: 90118382d1207f62fa602fb3431377c4f597cbb4481ed1cb5e07ccb8c4c245df
Instruction Fuzzy Hash: 01C12C62B0FAD90FE765EBEC58651E97FA0FF5235470901FBD088CB2A3D82469058341

Function 00007FFD9B37E618 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8ecee8a0197a1931e5d72f9c3bfb37e0e64da1dac2beebc68cbd3aa285e0fe
Instruction ID: 57cc71aafb551ac58f979cf4990acda8f5799153b10a9ece7d81416c12d69921
Opcode Fuzzy Hash: 0a8ecee8a0197a1931e5d72f9c3bfb37e0e64da1dac2beebc68cbd3aa285e0fe
Instruction Fuzzy Hash: D0A1086370E9950BE374A6AC78656F92B81EF853B470901FFE18CC71EBEC55AD028385

Function 00007FFD9B37E64D Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323836b6c7b6592168283ac9596550846924b93b9b21060625da6d0d0353754d
Instruction ID: 2815b205ca60c5f3cc88fa20c08425764fc330ba4401d82a0b51f9b95837646d
Opcode Fuzzy Hash: 323836b6c7b6592168283ac9596550846924b93b9b21060625da6d0d0353754d
Instruction Fuzzy Hash: 14A1086370EA950BE334E7ACB8656F96B91EF853B470901FFE18CC71ABD855AC024381

Function 00007FFD9B37B900 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57edf3e91bd949cf35de05643c039aab1ee4644d1aa213df8b365d60a5bbd667
Instruction ID: 43de9c628574bfbe61c499e1b085baeb9691a28746b437ba405c9685ebd81214
Opcode Fuzzy Hash: 57edf3e91bd949cf35de05643c039aab1ee4644d1aa213df8b365d60a5bbd667
Instruction Fuzzy Hash: F5A11A31B0DA4D4FDBA8EBAC98616B577E1EF89310B0541FEC44EC72E7D928A946C341

Function 00007FFD9B583E87 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049cf092abf09e603706dfa3e844304a763f0e419fe31610e247bab2328437fa
Instruction ID: 5cdc0b9cbc4c8bb3b80e2329e19e63a03a6175f8c1498bf8b07e4eaffd3675cb
Opcode Fuzzy Hash: 049cf092abf09e603706dfa3e844304a763f0e419fe31610e247bab2328437fa
Instruction Fuzzy Hash: 69A19A62B0EE8E0FE7A696B848651F57BE1EF55350F4901BED44CCB1A3ED28AD068340

Function 00007FFD9B3786DA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ce455271d79d1022b8763a0335b04c0e559361089ec97bf77d730e40bfc9fc
Instruction ID: bb573af20676ecc91f275b9d864e11a3b0f6de7c6762d8bfc93ab40bbc6f0dd2
Opcode Fuzzy Hash: 24ce455271d79d1022b8763a0335b04c0e559361089ec97bf77d730e40bfc9fc
Instruction Fuzzy Hash: B0B1F531E0E65D4FE7A4EBA588A57E87BE1EF46310F0502FED04DD71A2DA382946CB41

Function 00007FFD9B583581 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c551022a591daf5a69088cd4b3f5f228dde5719391da7c2b72a2d695da54ec5a
Instruction ID: cbbed21af81ae7c93657b9ed43551761f521ee476f71b1bc8a053f4a4fbfd070
Opcode Fuzzy Hash: c551022a591daf5a69088cd4b3f5f228dde5719391da7c2b72a2d695da54ec5a
Instruction Fuzzy Hash: E0A1C931B0EE4D4FEBE5DB6C84647A577E2EF98310F4501BAD04DC72A6DE38A9458B40

Function 00007FFD9B383BF8 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b640dc324cbe88d95d2a9d35b4c6d223690fb8e66bc40e0c86e9140a0a259c
Instruction ID: 499aba7a372b5b3406461711dfc609dc9c35fa93f9b411204101a3fd2b3eee91
Opcode Fuzzy Hash: 95b640dc324cbe88d95d2a9d35b4c6d223690fb8e66bc40e0c86e9140a0a259c
Instruction Fuzzy Hash: 80A1023071DE098FEB69EBACC4A0A7173E1EF55310B1605BDC08AC76A6DA35F846C781

Function 00007FFD9B37DE79 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e314627a2148727fafa2ca4db1264b2899e77d5e1fe2dfc6b98257f717fbb4b1
Instruction ID: e1620811985d8d681beb0cad027f5e53f085c84a56f7b935fd6361d316023c82
Opcode Fuzzy Hash: e314627a2148727fafa2ca4db1264b2899e77d5e1fe2dfc6b98257f717fbb4b1
Instruction Fuzzy Hash: 2B915A71B1DA890FE759EB2C98A597537D1EFA9350B0101BEE08DC72A7ED24EC428781

Function 00007FFD9B582CA9 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1ee7a268ce6fa2afd7ef28f34e5470390dcb29a6f12a86606da23d4c9bc1e3
Instruction ID: 0f062a69c7cad2d87db5110029121b13026707cc5e2852794cb33dde9dbfa896
Opcode Fuzzy Hash: 0e1ee7a268ce6fa2afd7ef28f34e5470390dcb29a6f12a86606da23d4c9bc1e3
Instruction Fuzzy Hash: A0916C21B0EE8E1FE7A6ABAC44652B13FD1EF55310B4501FAC458CB1E7ED296C42C381

Function 00007FFD9B581548 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eecff623d24f82803ba0befa720542ce795cf4dc96a91fa40816ef0c6872cf8
Instruction ID: f5713718dc36d8516467bd8a5fda35be0c98bdffaad0e3e3107236a5f28e9c52
Opcode Fuzzy Hash: 8eecff623d24f82803ba0befa720542ce795cf4dc96a91fa40816ef0c6872cf8
Instruction Fuzzy Hash: 6C912BB1B19E4E0FFBA9DBA8A4655B977E2EF94310B85007DE04AC71E7DD34BD058240

Function 00007FFD9B37CCC0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215907bb99efcab21f80e2f87ddd9f783a92fc720801c6fab642ca112bbb0bbe
Instruction ID: 693f959628b79c3bd44024e5b68c385ef144db06dcc5a7e780c9a6655303f755
Opcode Fuzzy Hash: 215907bb99efcab21f80e2f87ddd9f783a92fc720801c6fab642ca112bbb0bbe
Instruction Fuzzy Hash: F0A1C2B1F19A4D8FEBA4EB9898A57ECB7E1FFA4310F5401B9D01CC32D6DE2468418B41

Function 00007FFD9B58B932 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c54befaa50790fbd44d215e64cd66c0fa5c59d07e63c3de1c4aac0a6742452
Instruction ID: 86c92f88c0978252a8a68e8969ad8566d88351f2ed8a28cc1687f9c2f482c649
Opcode Fuzzy Hash: 19c54befaa50790fbd44d215e64cd66c0fa5c59d07e63c3de1c4aac0a6742452
Instruction Fuzzy Hash: A7B11A2070EB8A4FE7B6D7A844753B977E2EF42300F5545BEC04AC71E7DA2DA9468341

Function 00007FFD9B37E970 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af5e0f89f6fab3e230366644e9104678bf2ac49b8c7b1cdb350310528821884
Instruction ID: 45423154e9c43f7079fa94f196a6822b3fa3557b98bc9a22187497f1bf10bdd2
Opcode Fuzzy Hash: 1af5e0f89f6fab3e230366644e9104678bf2ac49b8c7b1cdb350310528821884
Instruction Fuzzy Hash: E881EB31B19D1D0FE7A4FB9C94697B937D2EF98360B0601BEE44DC72A6DD29AC424381

Function 00007FFD9B593088 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2eb405d153ae71c7bf597ee5de34c511602b1be290e89a4df51e84fe2171c36
Instruction ID: 1cd2e760cc3dde538b2de657ae564ccd4d5a558626fcd27d3a53853ac7033d04
Opcode Fuzzy Hash: b2eb405d153ae71c7bf597ee5de34c511602b1be290e89a4df51e84fe2171c36
Instruction Fuzzy Hash: 1A918C63A0F2960AF766A7BC68735E83B60EF03724B8D41B7C0ED4B1E3ED0939464245

Function 00007FFD9B384894 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 545cc0d96b079687b8940b7aa0d332e569c57574e51dee0d132cf31bb46273c7
Instruction ID: ba85f94e9bcef2f1e4a02e9fbe70608291fde825e9247eb397185c2f1a671b24
Opcode Fuzzy Hash: 545cc0d96b079687b8940b7aa0d332e569c57574e51dee0d132cf31bb46273c7
Instruction Fuzzy Hash: BB912530B19F4A4FE768EFA894955B573D0FF54310B15067DD09AC35A6EE38F8428781

Function 00007FFD9B385B70 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceabc23594c40428411796887c57540b814d0a3a92e2f9b23ceea0cf63bd00a6
Instruction ID: 1e9bfac9543e87d3169b324fd07719684ef01bea0d742cda0155f1228d8a5f6f
Opcode Fuzzy Hash: ceabc23594c40428411796887c57540b814d0a3a92e2f9b23ceea0cf63bd00a6
Instruction Fuzzy Hash: 0471E452B1FC1E4FF7B5E5DC187827413E2EFA8651722007BD88DC76A5DD24AD0A0382

Function 00007FFD9B58F5D8 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1a316109ccc3f689352f62450b3d42d23cb237ece4612eaa04498b9323f963
Instruction ID: 79abbdbebdd8092e0deee6818aec74b43e78c12168050711395764de8f34e7b1
Opcode Fuzzy Hash: 0b1a316109ccc3f689352f62450b3d42d23cb237ece4612eaa04498b9323f963
Instruction Fuzzy Hash: 43817192B1E59A0FF759A7FC68729E53BE0EF1631874902B6D0ADCB197EC097807C250

Function 00007FFD9B383C20 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf48e68075b455d5747994f93162cd8f51067cacf3e6e3cd58886f703d070089
Instruction ID: bea8d16a70a9aae75308d9814b6af969b70bc55304a1f07b743c20b5d1448a08
Opcode Fuzzy Hash: cf48e68075b455d5747994f93162cd8f51067cacf3e6e3cd58886f703d070089
Instruction Fuzzy Hash: 5391453061DF894FD729EFA894955B577E0EF95310F10067ED48AC76A2EE38F8428782

Function 00007FFD9B37D469 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103ec74f5f4beb6aef5c4aba2d940b493ee8b926a97123dc4ce6aa36b53880df
Instruction ID: 7b2afee079807a7cc521bcab6108b482a53de2ca7bc5bf93ea4fd80595d3b954
Opcode Fuzzy Hash: 103ec74f5f4beb6aef5c4aba2d940b493ee8b926a97123dc4ce6aa36b53880df
Instruction Fuzzy Hash: 2691A3B1F19A4D8FEB94EB9898A57ECB7E1FFA5310F5401BAD01CC32D6DE2468418B41

Function 00007FFD9B3773E1 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd6d8328719329b39821c0ced7636eeb547a34ee47f83176de498d2eeb0d1d7
Instruction ID: 80fa8de4a6e441a18e107b35305ab922167f7fff21b71c28d208abe034601a7d
Opcode Fuzzy Hash: 3bd6d8328719329b39821c0ced7636eeb547a34ee47f83176de498d2eeb0d1d7
Instruction Fuzzy Hash: 8AB1F770A0961D8FDB94EBA8C4A5BEDBBF1FF59300F1541A9C00DE72A5DA34A985CB40

Function 00007FFD9B3AE7A0 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e2761d42ffdc55a29de14ef5f32b0c14744cdf493d14b999d0910525f43727
Instruction ID: 39995f974d1551fb95753e3c752c5e5c59f17b4efccfbe11fd186a1297f6d202
Opcode Fuzzy Hash: d2e2761d42ffdc55a29de14ef5f32b0c14744cdf493d14b999d0910525f43727
Instruction Fuzzy Hash: 9781063170DB1D8FEB68EB98D891AB577E1FF95310B25067DD04EC32A2DA25B8438741

Function 00007FFD9B377DB9 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9643cb088b45fd95c83519c1f82bfa6e125aa90396837fede1e5be3a96832736
Instruction ID: 5616db21a57d5e423bfb6a312b72610ab3260e4319d4f6894516b4079fe6fe97
Opcode Fuzzy Hash: 9643cb088b45fd95c83519c1f82bfa6e125aa90396837fede1e5be3a96832736
Instruction Fuzzy Hash: CB91D471E0AA4E8FEBA4EFA8C8A5AADB7E1FF54344F01057DE019D3196DE746D018740

Function 00007FFD9B5850D3 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e297253b396b83f1e84a38522cc0a636e3c1406abeb8e9ff4c3607b6d3511f
Instruction ID: d650e7b2553f40cdfb221d2b3e1e9e5849b90795f91038c7c5e6cfe01d2f185d
Opcode Fuzzy Hash: e6e297253b396b83f1e84a38522cc0a636e3c1406abeb8e9ff4c3607b6d3511f
Instruction Fuzzy Hash: 11815E71B1EA4A0FE76AE7ACA4759F937E1EF41314B4901BAD049CB1E3DD28AD458340

Function 00007FFD9B37A015 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a215cd36305b04df8640a5e230559d73a16f6b95d9b01c522ce6552f71e5d9c1
Instruction ID: 8c7076ad68c94ecddde0e7ebdfeeed31e0fc51cf98a42e6a051cc2b50f64d534
Opcode Fuzzy Hash: a215cd36305b04df8640a5e230559d73a16f6b95d9b01c522ce6552f71e5d9c1
Instruction Fuzzy Hash: 9081487261DE8D4FE774F69880697A5B7D2FFA4360F05017ED08DC31A1DE38A9824342

Function 00007FFD9B5924CD Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4dd1d85bcbf7ea2958bb1237b349218fd15c6e00aafa2588eb304b2e6312ad
Instruction ID: 4135548a0c92ae728272528441a778b1fd1088505775e2b745475591c35d7d06
Opcode Fuzzy Hash: 2e4dd1d85bcbf7ea2958bb1237b349218fd15c6e00aafa2588eb304b2e6312ad
Instruction Fuzzy Hash: F391D8A2A0E2D50FE356A7BC58A26D53FE0EF03228B4902F7D0D9CB1D7E959644AC351

Function 00007FFD9B384BF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3d2db989e482ab7fe56b2e3b0e17eed47e5f8f32696698c054d04a36b28f6c
Instruction ID: d4c5976d4085b47d0470abacd0dddaded6bf7813da4f5aae298736b6589b3331
Opcode Fuzzy Hash: 3e3d2db989e482ab7fe56b2e3b0e17eed47e5f8f32696698c054d04a36b28f6c
Instruction Fuzzy Hash: 87712B22B0ED5D0FE7B9E7AC846477537D2EF99250B0901FED04DC72A6DE18AD468381

Function 00007FFD9B591EB2 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3fb089f2c7278db4384458fdcdbca490e5c5e9d8c9c9cbc6f88b6c01ba25a33
Instruction ID: 63f2785e608ea22846dbc97f38ed14b78fabc840551cb331efa1923e4c7a0d39
Opcode Fuzzy Hash: b3fb089f2c7278db4384458fdcdbca490e5c5e9d8c9c9cbc6f88b6c01ba25a33
Instruction Fuzzy Hash: 0981C671A1DA4A4BEBD9EF4880A19B573E2FFA8344F450179D44AC3297DE28FD42C781

Function 00007FFD9B374610 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90065a02e9b6bb5070137c052bcd5f78b41679f9c786c5384ea0ac45e86e265e
Instruction ID: 4ff59ffb9a27baba4250901f83d7dab076b4a28d956ce37f29a8ebbf22d660df
Opcode Fuzzy Hash: 90065a02e9b6bb5070137c052bcd5f78b41679f9c786c5384ea0ac45e86e265e
Instruction Fuzzy Hash: 4B910971A09A8D8FDB84EF68C894AEDBBF1FF55300F1401BED059D71A6DA34A846C740

Function 00007FFD9B584B35 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef996b56afb6fbb041e7e58c7098187907d411474c70c8ea3f66ca974e6d3be
Instruction ID: e37b1ef0c312d83fc0497656b28524ba7e85cc4ca2c5f0f80825e3cea767ca3f
Opcode Fuzzy Hash: 4ef996b56afb6fbb041e7e58c7098187907d411474c70c8ea3f66ca974e6d3be
Instruction Fuzzy Hash: 5B71C072B0EA4A0BF759ABAC64726F937D1EF41324B48027ED48EC72E7DD25BC414285

Function 00007FFD9B389C20 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a26533bc41cdf907e39beee813ffc34af3e924405825f6eb9a2bb9b8587a6c
Instruction ID: fe8b1e385a20069e77a2918201dd7863c6f19f465bc038e91499964f790db8c1
Opcode Fuzzy Hash: a8a26533bc41cdf907e39beee813ffc34af3e924405825f6eb9a2bb9b8587a6c
Instruction Fuzzy Hash: CF712330B1AE4D4FEBB9EAA884AC17577E1FF59310B0505BED08EC32A1DD29B8458342

Function 00007FFD9B3770FB Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ff2ada3b5d82186dace481ebc514b8d05b1aa793b5aff93bd6f3cdde2b3df6
Instruction ID: f82dc8cc1d9f0e00ba67781d7e808964e7c46fdcdebf73851d70c173c86a876f
Opcode Fuzzy Hash: 44ff2ada3b5d82186dace481ebc514b8d05b1aa793b5aff93bd6f3cdde2b3df6
Instruction Fuzzy Hash: CF613463B1A9294BE365B7ACB8A6BED7BD0EF85371B04017BE04DC7297CD14680643D1

Function 00007FFD9B374053 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76aee91311a740d51fc3e50549f9b52bb55414527efd6654320bdbe3209ab7b
Instruction ID: 70662e585e1c5602c77aab6fb7535614eaf5a2fa9558e248fb1d8f9ecea1a67e
Opcode Fuzzy Hash: a76aee91311a740d51fc3e50549f9b52bb55414527efd6654320bdbe3209ab7b
Instruction Fuzzy Hash: C8812431E0A65D4FE764FBA488A56FCBBE0EF52310F45027ED05D971E2DA386A46CB40

Function 00007FFD9B589BF8 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7546d7e64e1b85dbb825aa89a67be7ed73b550a588e10ea2fabe793cf0801eb2
Instruction ID: 7555635d198fd4e26f4bc5edad637217051847490c1ae3b8d9d6120c6f5e6fc0
Opcode Fuzzy Hash: 7546d7e64e1b85dbb825aa89a67be7ed73b550a588e10ea2fabe793cf0801eb2
Instruction Fuzzy Hash: 6E710470D08A5C8FDB98DF58C885BE9BBB1FB59300F1092AAD04DE3255DB74A985CF81

Function 00007FFD9B37D76E Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77f368a1afc5aa08c99399daa3b6a6eaf162f3f13c94c86b8be3b465c9b95be
Instruction ID: 87ad5c52876b7b8fa38ec82c2587ed8778eb8ddd6098b4b98535a744eb3e10e4
Opcode Fuzzy Hash: d77f368a1afc5aa08c99399daa3b6a6eaf162f3f13c94c86b8be3b465c9b95be
Instruction Fuzzy Hash: 0D615EB2A0EA4D5FE365EAAC98A52F977D1EF45360B0100FFD049C71E2DD282C428391

Function 00007FFD9B37E9FA Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62858dbb990c088a89a74f8e42d76feafca896b832b839c562f033929557cba0
Instruction ID: cbaaf779c6fba1adb6119bd019782bc9092687b4b35a22c3e69e5b6a041a1aea
Opcode Fuzzy Hash: 62858dbb990c088a89a74f8e42d76feafca896b832b839c562f033929557cba0
Instruction Fuzzy Hash: B7518722B0E95E5FE3B4E66C98692B637C1EF99770B1501BFD04DC71A2ED14AD068381

Function 00007FFD9B374667 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc82b0a82fffc5374940e777133f0d98da5a9d7e5e46dcefc72ca9b0d44caf4
Instruction ID: 329ba5059f7ae9b769077bfb0ced9e4263c4e273bf8d79e2a506d3d7cffca720
Opcode Fuzzy Hash: acc82b0a82fffc5374940e777133f0d98da5a9d7e5e46dcefc72ca9b0d44caf4
Instruction Fuzzy Hash: B381CB70A19A8D8FDB84EF68C895AEDBBF1FF58304F1401BED419D7296DA34A842C740

Function 00007FFD9B378D32 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5534c91ee095fdf12aeaf9d4ec361f6fb305db1514c0e7e1078b384413e270d3
Instruction ID: 30198c6df228c07da75d4f2dd2dbbf9cd984bc275c097ed57f69af53c4145ee6
Opcode Fuzzy Hash: 5534c91ee095fdf12aeaf9d4ec361f6fb305db1514c0e7e1078b384413e270d3
Instruction Fuzzy Hash: 3171D470D0A65D8FDB95EBA8C865AED7BF1FF4A310F0001BED049D72A2CA395981CB50

Function 00007FFD9B58725D Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff2ad6b83a26074a0800c4e4d8bfd77895398f5415443bdb9aa561d101a0705
Instruction ID: c21d056ea6a2c09232a2575db8cfa1b29c611425a33ab3e4e88c635f7e82450a
Opcode Fuzzy Hash: aff2ad6b83a26074a0800c4e4d8bfd77895398f5415443bdb9aa561d101a0705
Instruction Fuzzy Hash: 8461F47171DF8A0FE7A9EA68846997677D1EFA4340F5500BEE449C32B3EE74BC418281

Function 00007FFD9B378A55 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b5af65abe183b3a608821cf476346a74b3fe5966a61ce1676cee88cf75e5990
Instruction ID: 0543f6bf29f0b4a0f12cf959d7b40ec52b87860db5f2b228733c8c5393471e13
Opcode Fuzzy Hash: 6b5af65abe183b3a608821cf476346a74b3fe5966a61ce1676cee88cf75e5990
Instruction Fuzzy Hash: D2711470E0E68D4FDB65EBA498A56E9BBF0EF05310F0502BED049DB1E2CA2C5985C750

Function 00007FFD9B585438 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73c5637037694159e8805ee1274ebb07b5aae623bdf2bd16fa8af525669a0bd
Instruction ID: 66fcda47c65beead7c1caa5063f019836d8eedd6f5fc4bdb0d073352667109bd
Opcode Fuzzy Hash: e73c5637037694159e8805ee1274ebb07b5aae623bdf2bd16fa8af525669a0bd
Instruction Fuzzy Hash: 26510BA1B2DE0F0BFBE9AA5C646697933E2EF94350B85007DE45EC31E7DD25BD014240

Function 00007FFD9B376EA9 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e258f7136a81050df98dfb746fc6abfc707173c49a766338142de34cf4d4f2
Instruction ID: bf990292cb568b05cd5a19c4e208a4c24b8696b75bcf2facc041119857849a80
Opcode Fuzzy Hash: 42e258f7136a81050df98dfb746fc6abfc707173c49a766338142de34cf4d4f2
Instruction Fuzzy Hash: 5D611671A0EA8D4FD765EBAC98646ED7BE0EF46320F0541BFC089CB1A7D9285C45C780

Function 00007FFD9B37E648 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 929e19fec38ea6247f8c9a577a690da34aa6863b2498323c3754967c4c25ecf8
Instruction ID: 410663bf1cf7df6270b993a796059d755c0176aca9a04972f6e3c4b708488af4
Opcode Fuzzy Hash: 929e19fec38ea6247f8c9a577a690da34aa6863b2498323c3754967c4c25ecf8
Instruction Fuzzy Hash: 6A51213031AE0A5FD768EE98D894A7173E0FB98714B15067ED44DC7272DE35F8828382

Function 00007FFD9B374C41 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b0de873f094f04416a68ec1636eb16b2590d1345d8d7a134516db5fab46798
Instruction ID: 551117ced7d1b8846eacc37ae21659bbd1b5fa7e901a4c3ee12699d5ea27e4b8
Opcode Fuzzy Hash: 23b0de873f094f04416a68ec1636eb16b2590d1345d8d7a134516db5fab46798
Instruction Fuzzy Hash: E4613631A0AA4E4FE795EB6C9868AEC7BE1FF45350F0501FED049DB2A2CA786D45C740

Function 00007FFD9B58D631 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59fd51237d19728b353d64cc1b2a6ecc08f078fe340955ff72e6a861a3413293
Instruction ID: d12160110ce395c257b5c4ebaafe730bc5e203c2623a3f6e0925831e2087df75
Opcode Fuzzy Hash: 59fd51237d19728b353d64cc1b2a6ecc08f078fe340955ff72e6a861a3413293
Instruction Fuzzy Hash: 9D71BE30E0A94E8FEBF6EA5888657E877E0EF59310F4101F9D05DC71E2DA786E858B40

Function 00007FFD9B585366 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9103b76986841b8d7ceaf56e94335edc7f662e269777bbd63cbd2beef4cf50
Instruction ID: 5cec0ec572c5a9690e8ff90105f87a74d85a63b4cee0587703b2e697195241ee
Opcode Fuzzy Hash: cb9103b76986841b8d7ceaf56e94335edc7f662e269777bbd63cbd2beef4cf50
Instruction Fuzzy Hash: 83513AA2B2DE4F0BFBFA9A6D64A557863D2FF94350B8000B9E41EC71E7DD25BD024240

Function 00007FFD9B37A860 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c4ced6d9cc8d6b48ecf1bacdc606b4cb9f5788df65b5aec9674bfbd1cf3eff
Instruction ID: 36f98917e8d774eb258271d0dcd555aac7b43d1076f821a02b3901543438ddf7
Opcode Fuzzy Hash: e2c4ced6d9cc8d6b48ecf1bacdc606b4cb9f5788df65b5aec9674bfbd1cf3eff
Instruction Fuzzy Hash: 5551C742F2F99E1BF775B6E854B15BC6B90EF52360B0942FBD09C871E79C483E464281

Function 00007FFD9B37C65D Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22bae219d6e728d2c24ef473b01f84f23ed99475cce036f0505c352c3b5ea70a
Instruction ID: 9a77bb0bf6fdf67dec3ddde12151e509c6d921ab8bed62cb1ba85704f3c7f0ad
Opcode Fuzzy Hash: 22bae219d6e728d2c24ef473b01f84f23ed99475cce036f0505c352c3b5ea70a
Instruction Fuzzy Hash: C851923071991D4FEAB8FA9D94A5A7937D0FF59711B1100BEE88EC72B2DD24EC428781

Function 00007FFD9B58CF7F Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09563f90d6199a1be634ed280fbb5a7ec0d9c36a2940dfbe736695100a2eba36
Instruction ID: 32dddd427edb23f7b23f2d0a627c938ade8bc1c1808c1e328c0860b30f95542a
Opcode Fuzzy Hash: 09563f90d6199a1be634ed280fbb5a7ec0d9c36a2940dfbe736695100a2eba36
Instruction Fuzzy Hash: 4F51D421B1EE4D0FEB9AE67D44296757BD2EF99210B4500FED44DC72E7ED18AC428342

Function 00007FFD9B37A868 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8cf8ffd92b8d6d34a05d978afd20a62aec1ff1818643b399fda0a8e0e0d8004
Instruction ID: cc0e9309176ab8d5d5287bff7fd1769f029c200ae7a3949157bcf473c24b26eb
Opcode Fuzzy Hash: f8cf8ffd92b8d6d34a05d978afd20a62aec1ff1818643b399fda0a8e0e0d8004
Instruction Fuzzy Hash: 8651C642F2F99E1BF775B6E854B15BC6B90EF52360B0A42FFD09C871E79C483A464281

Function 00007FFD9B58CF58 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235f9afe75316cb88e61012bfb4b9eba6dfa907ce44797c9c2780882cfc9f80f
Instruction ID: 3c407f38a2aa76e3d90e79ebfa5d3f1559d706d18950f23d97ac99eb97534864
Opcode Fuzzy Hash: 235f9afe75316cb88e61012bfb4b9eba6dfa907ce44797c9c2780882cfc9f80f
Instruction Fuzzy Hash: CE51C521B1EE4D0FE79AA67C48296757BD2EF99210B4500FED44DC72E7ED18AC428342

Function 00007FFD9B37BEB7 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672b046d2659232f97effd63b3b5b06d3edb2fe8f777e1a632c3ba8b55d5abdf
Instruction ID: 785918de27f522c34a24e9e1f968db7f1c1625c0b081977bad94806a1faadf3a
Opcode Fuzzy Hash: 672b046d2659232f97effd63b3b5b06d3edb2fe8f777e1a632c3ba8b55d5abdf
Instruction Fuzzy Hash: AA41F721B1EBCA0FD766EB7848B45657BF1EF9621074A41FFC089C71E7ED18A8068341

Function 00007FFD9B37ADFA Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9b2c9bd48bd139f1b84ffd66046a0d88351cab52bd51089f099f79f79d7e16
Instruction ID: f64263b7623445618b82549b060af59b0bc46dc8fc9c75151b67e5c286011991
Opcode Fuzzy Hash: 9c9b2c9bd48bd139f1b84ffd66046a0d88351cab52bd51089f099f79f79d7e16
Instruction Fuzzy Hash: 0D41E722B2EE4E4FE7A8EA6C94A56B573D1FFD4260B4501BED04DC7696ED18EC024381

Function 00007FFD9B580FF4 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71fa0cb4293971da5c3f5592b942e4e407115539b4ba0b70dd4b3b9c83b24fc3
Instruction ID: c3d56ba335e584977b1417dd02f2ef25577feb4a1a09fa7bac986d76be1a61fd
Opcode Fuzzy Hash: 71fa0cb4293971da5c3f5592b942e4e407115539b4ba0b70dd4b3b9c83b24fc3
Instruction Fuzzy Hash: B5412431B1DF4D8FEBAADA5C881A57977E1FB98710B55023AD489C3262DE30FC428781

Function 00007FFD9B581D22 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69189b607fa9f986944d2316531218b38f96730be8d288df3334585625d64e78
Instruction ID: e25927369f890cc6a39c07779a7981c6c6a483c166b639578c360bbe0f435083
Opcode Fuzzy Hash: 69189b607fa9f986944d2316531218b38f96730be8d288df3334585625d64e78
Instruction Fuzzy Hash: 6651EB7070EA495FE366EBB48865DB977A2FF8430476141BCD04ACB1A7DE39A842C740

Function 00007FFD9B581D16 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69189b607fa9f986944d2316531218b38f96730be8d288df3334585625d64e78
Instruction ID: e25927369f890cc6a39c07779a7981c6c6a483c166b639578c360bbe0f435083
Opcode Fuzzy Hash: 69189b607fa9f986944d2316531218b38f96730be8d288df3334585625d64e78
Instruction Fuzzy Hash: 6651EB7070EA495FE366EBB48865DB977A2FF8430476141BCD04ACB1A7DE39A842C740

Function 00007FFD9B383C30 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e3fd8b6909ddc0af7067693ec2b4883c3a2ad95be0d0377099cb2f41afc631
Instruction ID: 668de920dfe5ad3bf15939a24ccb3d8bf5954932fad26f8697182788fbad398d
Opcode Fuzzy Hash: b6e3fd8b6909ddc0af7067693ec2b4883c3a2ad95be0d0377099cb2f41afc631
Instruction Fuzzy Hash: 8441243061AE0E4FD765EB99C894A6173E0FFA8300B16067DD44DC76A6DA35FD82C782

Function 00007FFD9B374605 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25df920078de056d6d2a5d5e46b1547b6b50cd7639f03534db21f678cbf3e207
Instruction ID: 00d5ca5c657cbdb7c3c2ab36b0da95285be6f4aa229d633cd085ac16e4a74bc5
Opcode Fuzzy Hash: 25df920078de056d6d2a5d5e46b1547b6b50cd7639f03534db21f678cbf3e207
Instruction Fuzzy Hash: 3851453060AB0A8FDB69EB29C070EA577D1FF5535476549BCD04ACB5E5CA39E882CB00

Function 00007FFD9B581000 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ed2771d3b2dd6766f6aed1520927a298f3326ac52da195cbf27c5d55d2e460
Instruction ID: 32b525c985b135806b86f0ab0d432f9ae4e353d9fe0531075e7ee0b845dc8761
Opcode Fuzzy Hash: 82ed2771d3b2dd6766f6aed1520927a298f3326ac52da195cbf27c5d55d2e460
Instruction Fuzzy Hash: 5841C431B1DF4D8FEBA9DA5C981A57673E1FB98710B55023AD449C3266DE30FC424781

Function 00007FFD9B376451 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f3e0e845170e3342a5757a3140e68f634a91ecc0f50ea65e2face7a497f7e5
Instruction ID: 709e74d5b5a070826846011ca4299a5cbfd54f8fadd94053dae0eec8aad27bc9
Opcode Fuzzy Hash: 02f3e0e845170e3342a5757a3140e68f634a91ecc0f50ea65e2face7a497f7e5
Instruction Fuzzy Hash: 8651EA70E0961D8FDBA8EBA4C4A57FCB7B1EF55300F5590ADC00EE7292CA386985CB00

Function 00007FFD9B37F5C4 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6464f3c6730bf9c669872236cc3e34ab7d986334c40b1f7e3942e7035073e196
Instruction ID: 83f4c78129c72ef29144e9bd6b58bad85ca2bdeb9bb78a64822a68a0f9d8d65b
Opcode Fuzzy Hash: 6464f3c6730bf9c669872236cc3e34ab7d986334c40b1f7e3942e7035073e196
Instruction Fuzzy Hash: 27512371E1995D4FEBA8EB58D8D97A8B3E1FF58350F0001F9941DD32A6DE346E818B40

Function 00007FFD9B4F018D Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2976338412.00007FFD9B4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b4f0000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a284bd1e1e0f816fc23a5dd48e8706be92c815c47a07595fad527c38ca49443
Instruction ID: d8ab8c804185e7310a61e5ef6b004b6f7f149dc18eff96e83ccd8653623396ca
Opcode Fuzzy Hash: 8a284bd1e1e0f816fc23a5dd48e8706be92c815c47a07595fad527c38ca49443
Instruction Fuzzy Hash: 0E410821A0E7C94FD762DF6888695E97FF0EF52214B0A01FBC488CB1A3DA285946C352

Function 00007FFD9B58FB45 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2e4d1765f757f71dfb27499b9fd8a78e627d6e707d842713607173bd7f27c4
Instruction ID: 910aae48b33a806e6138766873b6aefada47793007336166a0f4ed9553c4ec32
Opcode Fuzzy Hash: 0e2e4d1765f757f71dfb27499b9fd8a78e627d6e707d842713607173bd7f27c4
Instruction Fuzzy Hash: 3F41C171B1CE484FEB98EB2C94556A9B7E1EB98310F1001BED04EC3296DE35A9868B45

Function 00007FFD9B382A2D Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35fdafb022db4787256f825b735561eee230d456078ce246549b91cb2eabe12e
Instruction ID: 45ffb28d28f2a924e1a99f8a0a1669137c5c5fd6e09dc0d292eca9eead4f0f00
Opcode Fuzzy Hash: 35fdafb022db4787256f825b735561eee230d456078ce246549b91cb2eabe12e
Instruction Fuzzy Hash: 3441E231B1EE8D0FEBA6EAAC98A496137D2EF5530071A40FED448C72B3DD25EC458346

Function 00007FFD9B58BEE7 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fbdf02c426a503c4bde5316736f4d31c31d70f369486f176fdf1db3f40cfc14
Instruction ID: ac071c369b3f8ae114e62ed509026ebd8ac7e78e82376261225322bc3864f41e
Opcode Fuzzy Hash: 3fbdf02c426a503c4bde5316736f4d31c31d70f369486f176fdf1db3f40cfc14
Instruction Fuzzy Hash: 6A513A2061DB8A8FE3A6977490616F437E1EF41320F4540B9D08AC71F7EA6E6D87CB90

Function 00007FFD9B37A010 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2c356bfa0e4f898a85bd79a7d8449d92c12c1a07d97093896f18e6efec4866
Instruction ID: f27b5a15f995d9b1a5c5fff9bdb8e9681f634b023448e0846ae9098866059ce0
Opcode Fuzzy Hash: 4c2c356bfa0e4f898a85bd79a7d8449d92c12c1a07d97093896f18e6efec4866
Instruction Fuzzy Hash: 6941B33071DE4A8FEBA5EB6CC0A4EB277E1EF55300B1645ADD04ACB6A6CD24F845C741

Function 00007FFD9B375768 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47aef94b7d689c3450d3fb18911ba3660a5cb79d325b5db1546c82efd65373e
Instruction ID: a571af78ddf3e8ca434b6845ba136a97be4c133366db431d328caf17d4dd10ab
Opcode Fuzzy Hash: c47aef94b7d689c3450d3fb18911ba3660a5cb79d325b5db1546c82efd65373e
Instruction Fuzzy Hash: 0B41C631A0A64D9FDB58EBA8D4656EDBBB1FF46310F0600BED049E72A2CA796841C740

Function 00007FFD9B379CE0 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d49b25e02280953018ed4fd1373b1d054b7b0b8c3d0dd5dab74b5014155b21f
Instruction ID: aef188bf640f46261cf516d327a6f006e9b1de294e1d488636ec8446be462e73
Opcode Fuzzy Hash: 5d49b25e02280953018ed4fd1373b1d054b7b0b8c3d0dd5dab74b5014155b21f
Instruction Fuzzy Hash: 2141E162A0EBD65FD762A3BC98AA4D57FE1DF8727430942EBC0848F1A7E45C4C878351

Function 00007FFD9B37EA2D Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543b147f262d8bb613cd65bd069d5065ec0c8ff6f1b4fbb81c544dead63b0cd4
Instruction ID: d4467a73fb147420fea24d2bf7ba80b5ab52aa4cefd1a0c8b1421352cd3ddfdd
Opcode Fuzzy Hash: 543b147f262d8bb613cd65bd069d5065ec0c8ff6f1b4fbb81c544dead63b0cd4
Instruction Fuzzy Hash: 41411872B1916A4BE754F76CE8A66EC77A4FF41325F0401BBD14DCB2A3DD2469828780

Function 00007FFD9B380220 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c201edfa458fec6a852f43d02e6549206c3052c5453edd9900ed061d05da0d0
Instruction ID: 28e8f9e4bb70a2af81e85221f4228d493829e47420c860f41ffaadedb344fff9
Opcode Fuzzy Hash: 5c201edfa458fec6a852f43d02e6549206c3052c5453edd9900ed061d05da0d0
Instruction Fuzzy Hash: FA415230B19E4D4FDBA8EF98986567A37D1FFA8310F11016EE40DD3295CE35A9018781

Function 00007FFD9B382CA8 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e0a6b5cf5548e3090a879814e4504d5d7f8f7c9b4525628ce5c58cc831c448
Instruction ID: 5f0fcc3a9c2aa385e608cb6d21053a929dda9a9922ddd32dc1db688904111104
Opcode Fuzzy Hash: 01e0a6b5cf5548e3090a879814e4504d5d7f8f7c9b4525628ce5c58cc831c448
Instruction Fuzzy Hash: 86314A62F19D5E0FF7E4FAAC94292B933D1EB94310F05057FE84DC61A1EE689D424382

Function 00007FFD9B58EA8D Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b087c471bece269a2f0ec314adbb02d605053f604a4068ca38565e5746e8ad3
Instruction ID: 1e210cfe10b2bf8908c5a0dafd106531d1749ca8149e5158c275e42364e7f896
Opcode Fuzzy Hash: 1b087c471bece269a2f0ec314adbb02d605053f604a4068ca38565e5746e8ad3
Instruction Fuzzy Hash: 3141AF71E0AA8D8FDBA5DBA484693FD7BF0EF45311F45407ED049971A2CA781944CB80

Function 00007FFD9B373CAD Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d53e9e9b5a20b1441e9fc54836d45341924f8dcf7b31bfac9cb2145cc3c809a7
Instruction ID: 643e408422c02cfdc299472ca91c882bc373ec5475f85cb631689acfdd2b8ae2
Opcode Fuzzy Hash: d53e9e9b5a20b1441e9fc54836d45341924f8dcf7b31bfac9cb2145cc3c809a7
Instruction Fuzzy Hash: AE412D71E1A61D8FDB54EB98D4A5AFCBBB1EF58300F51013DD049A7291DF386A46CB40

Function 00007FFD9B3735C7 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d443c828600b3391d885a88259bb91c51e9b199be108f6e99cabd289c628e1
Instruction ID: 19ced6065b124bc2d1c95f874c95711135d4dd582772b5096190aa1e4f2d7bee
Opcode Fuzzy Hash: a3d443c828600b3391d885a88259bb91c51e9b199be108f6e99cabd289c628e1
Instruction Fuzzy Hash: A141EA71A0A64D5FD3A5EB7C98A55E9BBE1EF42270B0501FEC049CB2E2DA281D46C741

Function 00007FFD9B385138 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7597876711948b3725a238b9a9835615fce79fc8b00f1dd16d0d4ded5b73c21b
Instruction ID: f26548a0d472232385c40666ff70b0d423389fe981751cc29039fdb73ff7956b
Opcode Fuzzy Hash: 7597876711948b3725a238b9a9835615fce79fc8b00f1dd16d0d4ded5b73c21b
Instruction Fuzzy Hash: 1541A23071DE498FDBA5EB6CC0A4EA277E1EF59300B1645A9D08ACB6A6CE24F845C741

Function 00007FFD9B587939 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed48f66ef68fcf34431691e94944551b54082446b7ef3006e9ed1be760726f7a
Instruction ID: 839ef00e4004ce6da2714f9b7edf986a7e4ba643f5416dc8192e69e17e681bf2
Opcode Fuzzy Hash: ed48f66ef68fcf34431691e94944551b54082446b7ef3006e9ed1be760726f7a
Instruction Fuzzy Hash: 3241463064EA8D9FD796EB68C865AB27BE0EF51314F4504FAC089CB1B3D639E941C790

Function 00007FFD9B588C3C Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df60297ca62da517e0ee4e17a14ab59defefdd2636252d936146888ab744fab
Instruction ID: 7090c32ac3e934e952d24f0b1337c3c6120c3326d5d72781a6a53719932b9fe6
Opcode Fuzzy Hash: 9df60297ca62da517e0ee4e17a14ab59defefdd2636252d936146888ab744fab
Instruction Fuzzy Hash: 8731A071A0FBCD4FE7679BB98C254A87FB0EF02204B4901EBD0849B0E7DA685849C352

Function 00007FFD9B383FED Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c388ec723a60dfc74d0e2e06395d9f18b56cd9f7da3ff3ab3ea93c0893081204
Instruction ID: fb4da7ee9c55760a7b7f4e17eaa19a435254c82298e0c449653bf12ef53ec7f2
Opcode Fuzzy Hash: c388ec723a60dfc74d0e2e06395d9f18b56cd9f7da3ff3ab3ea93c0893081204
Instruction Fuzzy Hash: E531E782B1FED50BE361B2ED68B54E66B90EF5226474A02FFD0D9C75E3DC1819078352

Function 00007FFD9B58FBC8 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3afef76d3fcb8dcaa14a12b6c5ae5aa8e8c755a6c3aa9ede78accdea5cc18f65
Instruction ID: b187f7ae3298f7ef15d5c0ea74f4c1b576f3b8564f248ba086a989e505405991
Opcode Fuzzy Hash: 3afef76d3fcb8dcaa14a12b6c5ae5aa8e8c755a6c3aa9ede78accdea5cc18f65
Instruction Fuzzy Hash: 3C310472B1DE494BEB8DAA2C54265B573D2EB98304B5001BEE05EC32D7EE25A8428645

Function 00007FFD9B580B3A Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4031e1a6c1a1268936ddbe77394fb4d5ad1d5228bbe3faca5ba4b7e1151d61a5
Instruction ID: 3db10f15f0862e6962d98e99a372f54c2fb0b187a6afc6b6d4d42c4d1431d867
Opcode Fuzzy Hash: 4031e1a6c1a1268936ddbe77394fb4d5ad1d5228bbe3faca5ba4b7e1151d61a5
Instruction Fuzzy Hash: B941BF30628E4A8FEB95EB28C064AA9B7E1FF58340F4540B9D44AC72B7DE34EC45CB41

Function 00007FFD9B584122 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ff7abfedf7efa9a2ab6fcb0d23671c9ecbd838fadc7df48a96b76ea0c97287
Instruction ID: d7004bd2e6eb35f1a54591a3bdd97d98c6510aded7b6543110bf4cd95f9002e6
Opcode Fuzzy Hash: c2ff7abfedf7efa9a2ab6fcb0d23671c9ecbd838fadc7df48a96b76ea0c97287
Instruction Fuzzy Hash: FB319C61F0EA8E0FE7AADA7C58665F87BD1EF55350B4501BEC459CB1A3ED286C064340

Function 00007FFD9B383E87 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3ba4557130f3e21bf1b70b4c5b22997c4c72d2580fb55538c43bb35056ac71
Instruction ID: 188c5f2408cd9491ac7623ee2f89a92cefde29b203fd88e0e9b037e46a235b6b
Opcode Fuzzy Hash: 9e3ba4557130f3e21bf1b70b4c5b22997c4c72d2580fb55538c43bb35056ac71
Instruction Fuzzy Hash: 8931083271DD280BE768FA5CE8656E573C0EF98765B0405BFE489C3296CD656C0683C2

Function 00007FFD9B37BB05 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68d9966a838dd4e191508da5c64868b02eb41ee0669f1c420d13549cf97cfb9
Instruction ID: d61cf39bb6330718e398bbf889b854b79a8cfeaee028e2edffddced5866f446c
Opcode Fuzzy Hash: b68d9966a838dd4e191508da5c64868b02eb41ee0669f1c420d13549cf97cfb9
Instruction Fuzzy Hash: 99416C71A0EB8E5FE364EBB848766D97BE0EF01250F0501BEC459CB1D3FD6829458741

Function 00007FFD9B384028 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb61dcda8ce469e44ca6d2c28d5885d5b1e8eadb60de33aaad46643e92ab263
Instruction ID: 7839780723c6b075595f48296639f8520daa8088dac958a6ac7371dbcfda0a8d
Opcode Fuzzy Hash: eeb61dcda8ce469e44ca6d2c28d5885d5b1e8eadb60de33aaad46643e92ab263
Instruction Fuzzy Hash: 5821062271ED4E4FEBE8FA9C54B46B923D2EF98261B41417AD80DC36A5DD25ED028340

Function 00007FFD9B58A4C4 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 510d2aa9b993010519322f73879b522dab2232fe2e38a22433eb60e2cd3f8601
Instruction ID: 330499392556d7bb64330794534b6eabcfe411e16a86d1aa2638cd8ac55025e9
Opcode Fuzzy Hash: 510d2aa9b993010519322f73879b522dab2232fe2e38a22433eb60e2cd3f8601
Instruction Fuzzy Hash: C6318130719E494FEBA4E76CC4A4BA6B3D2EF98300F4545B9E05EC72A6CE34B9418B41

Function 00007FFD9B3A6F20 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce6102cc7bb4396470d2e9122af57d4e909bdcc5d05afcfc242fdab16401161
Instruction ID: 8c77c35d437c141171c0fb813787241727f5509c2c5940faead95a2142dda46b
Opcode Fuzzy Hash: bce6102cc7bb4396470d2e9122af57d4e909bdcc5d05afcfc242fdab16401161
Instruction Fuzzy Hash: 20314D71E0921E8FDB18EFA8D4906EEBBF1EF49315F20413EE419A3290DB749954CB90

Function 00007FFD9B382B75 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba5888e39e1215976c2c2d6392cd6767f4efbd43e8d5e6b49d495aef212c081
Instruction ID: dd2319b2610422ec7943e3fa0b0969650dc9d1c44759dee90de1321cc55f2f50
Opcode Fuzzy Hash: 8ba5888e39e1215976c2c2d6392cd6767f4efbd43e8d5e6b49d495aef212c081
Instruction Fuzzy Hash: 15214B32B0EA5A46E7B8B9ED78B50B87FC1DF8426471A01BFDC4CCB1A2D8161C42C284

Function 00007FFD9B4F0C19 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2976338412.00007FFD9B4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b4f0000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750842f19951e489059eabef7941eb8ded4f5ac17235a55492999e390c059de6
Instruction ID: 8a888b86de8e4161fafc643f23f99e9600e79451d49dd8d454adfd04813c7dc8
Opcode Fuzzy Hash: 750842f19951e489059eabef7941eb8ded4f5ac17235a55492999e390c059de6
Instruction Fuzzy Hash: 1621F47190EBCD4FDBA5CFA888A95E97FF0FF52310B0501EBD444CB1A2DA2455468741

Function 00007FFD9B37852F Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268d16afe6e2b5ea8696c3a83ea741868415b70f12785cf34d70049afe99914d
Instruction ID: a589e0e1818898eaaae630929e1c4b4e84e0bd96f0bf2ad1676a7cdf0ea83e09
Opcode Fuzzy Hash: 268d16afe6e2b5ea8696c3a83ea741868415b70f12785cf34d70049afe99914d
Instruction Fuzzy Hash: 5931D771E0AA4D9FDB54EBA9C8995ECBBF0FF15320F4402BED049D71A2DA3828428740

Function 00007FFD9B37E1E8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 284065e96a8438fae6048a69c3a9285f942c5db3330c8a8d8a48f946e5f350e2
Instruction ID: 8bcfd8c9f746087aabe7b2d71b71e6815fee7f1a18f4425f23f569b2d77c3bc4
Opcode Fuzzy Hash: 284065e96a8438fae6048a69c3a9285f942c5db3330c8a8d8a48f946e5f350e2
Instruction Fuzzy Hash: 04212E31B09A0A4FE759FB3C84656BD37D2EF95310B05457EC05AC71EBDD2879024741

Function 00007FFD9B375201 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1b53c7e6f58d8120579a5a998f07636e46643ba63bbc2c61442cae83c74696a
Instruction ID: 6db63b26bcfe50d135457cb9e3106db80b653d0c59f2ff8baec44ff7ab2ebf86
Opcode Fuzzy Hash: b1b53c7e6f58d8120579a5a998f07636e46643ba63bbc2c61442cae83c74696a
Instruction Fuzzy Hash: 0021B271D09A5D9FDB84EFA8D8A56EDBBF0FF64310F0500AFD009E72A1DA649881C781

Function 00007FFD9B37EAE5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f1c0cc579acaae6654ff17f72150b1adf2d33b51b4eac6092bee9f3b9621a7
Instruction ID: 0139fb76f715b153d0f2db847049818bc9494b5bf3e7c953f5343b999c8547d3
Opcode Fuzzy Hash: a7f1c0cc579acaae6654ff17f72150b1adf2d33b51b4eac6092bee9f3b9621a7
Instruction Fuzzy Hash: B1219871E1E69D4FE7A9EB68C8A52A877B1FF55304F0101BED04DD71A2DE345982CB40

Function 00007FFD9B37D325 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9efb5482cfdfb85bb8688b4c3c4b1133a755f2b85c86f3b3e08a550eecd76801
Instruction ID: 2525e11501cd99d1d1a0305d7cc4fe7b1f3e27f6d8b7492d8e35ba358cd50cef
Opcode Fuzzy Hash: 9efb5482cfdfb85bb8688b4c3c4b1133a755f2b85c86f3b3e08a550eecd76801
Instruction Fuzzy Hash: 0B216822B1DA864AE365F338A4A16E57B90EF81314F4544BED0DECB1E7DD5878898340

Function 00007FFD9B372E38 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095d8cd10ace367d4499155e33b9f1a492de0f2867359b5976cd56a94b7a3369
Instruction ID: 775026be1167b505a117da64a271997bf7d2b60dc5cba8a4c5fb55a6126af8b4
Opcode Fuzzy Hash: 095d8cd10ace367d4499155e33b9f1a492de0f2867359b5976cd56a94b7a3369
Instruction Fuzzy Hash: 8121FB22A0F98D4FEB61EFAC9C946E97BE0FF56200F0500BED448C71E6DE24A941C741

Function 00007FFD9B37BF1D Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8642d04616bcdcc7d3bd2c2d04eb52794a122a7863f69e95bc12e0360532b240
Instruction ID: 2702d05e1546cf04d0ad1b6fa3bc48916fe2345d9c2792a5c0dbc5c68c7ea8d3
Opcode Fuzzy Hash: 8642d04616bcdcc7d3bd2c2d04eb52794a122a7863f69e95bc12e0360532b240
Instruction Fuzzy Hash: 9C213731A1EB8A4FE7A5EB2884B55A177F1FF5520074541EFC089C7296EE18EC458741

Function 00007FFD9B3789A5 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91963add35f6e77666bd3fba19432cce89eff72c5e287c3f3e9f954bcb8960d
Instruction ID: 83d4a7507d18363e4bbdc78e4f5347287539c6bca94495803216122ea9c74071
Opcode Fuzzy Hash: d91963add35f6e77666bd3fba19432cce89eff72c5e287c3f3e9f954bcb8960d
Instruction Fuzzy Hash: CB21F430D0A64E8FD7B4EAA594906E8BBA0EF42320F1503BDC45C971E1DB389A85C745

Function 00007FFD9B37425B Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf583f9c91d31a0e93dfd0d55520b9f0affc2a8544b70f8ec4519a03aec56bb3
Instruction ID: 1b8a65d7ab7080297f4465427cf513d8ed2ebf9dbb6bb3dd3d28b639b62ea0e6
Opcode Fuzzy Hash: cf583f9c91d31a0e93dfd0d55520b9f0affc2a8544b70f8ec4519a03aec56bb3
Instruction Fuzzy Hash: 7C219F3188E3C95FD32297A068625E97F74DF03211F0B01EFD088DB4A3C51D669AC762

Function 00007FFD9B58CCBA Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76d55ddc1a6f7fb033a6162d0bd1321b12e0a959edf03d462afe4bda764ccf0
Instruction ID: 59d856f31646888f82c1c7ca0c342fa349b85fdd6dcae4c9e8eb3742f633cdcc
Opcode Fuzzy Hash: c76d55ddc1a6f7fb033a6162d0bd1321b12e0a959edf03d462afe4bda764ccf0
Instruction Fuzzy Hash: 8921F33150EA8E8FDB89EF68C859DEA7BE0FF55320B0405AFE409C7162D630E955CB80

Function 00007FFD9B5892FF Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1eec6360623806bd2a0ac46fdfb040f6dccd9acd7af8c94bf5d96a5705f775c
Instruction ID: 8b965b0d6f84dba4cbb99d9ab1f2fd9db9fb9b5ed0f00f2ef8d8f3f4be503dd7
Opcode Fuzzy Hash: d1eec6360623806bd2a0ac46fdfb040f6dccd9acd7af8c94bf5d96a5705f775c
Instruction Fuzzy Hash: C121F83190E68E8FEBA6AF6888211A93FF0FF15310F0941B6D84CD74D3DA38A559C781

Function 00007FFD9B5817A2 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf6752cbff95729142fa20a6800d2e3d56d99abb07118b8180d910c716e2606
Instruction ID: 695890b07849a63fa4a8f44dee93d015c383f9a8632aeff003a2139c596c125f
Opcode Fuzzy Hash: fdf6752cbff95729142fa20a6800d2e3d56d99abb07118b8180d910c716e2606
Instruction Fuzzy Hash: DC214B33A0D6894FE7EAD6AC94965E87BD1EF55310B4500FFC486C71A3DA346546CB40

Function 00007FFD9B5821FA Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa78ff940f4356df409869f839ec97e130d90e7d4990eab55d2d025f3fa6654
Instruction ID: b01069e015c224c735876070ea8559f151305386db12c335d8a7c029f9f7dea7
Opcode Fuzzy Hash: 2fa78ff940f4356df409869f839ec97e130d90e7d4990eab55d2d025f3fa6654
Instruction Fuzzy Hash: 2E21F831A1EE1D4FEBF6A69C64159B93BD1EF54350F8101BAD00A871A2DD35B941C681

Function 00007FFD9B375220 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871b36d3d656d017ad3ab7b2a6f1afe68bd831f2f8f264f3b424fa9c0dcbaa81
Instruction ID: 4143189ed24f6966a42ce81513ae36ac949ba41784a3953d15850d8b245744d4
Opcode Fuzzy Hash: 871b36d3d656d017ad3ab7b2a6f1afe68bd831f2f8f264f3b424fa9c0dcbaa81
Instruction Fuzzy Hash: AA218071D09A5D9FDB88EFA8D8656EEBBF1FF55310F00006ED009E72A4DA746881CB81

Function 00007FFD9B587960 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d753b9c09dca71891f00e077eeb44e2f4f723a30e0d19e1c8325d0e384f8788
Instruction ID: 9f03dd58e0007c0d2c221a206d0439919847ca9e5db308c1df9513918a76571c
Opcode Fuzzy Hash: 6d753b9c09dca71891f00e077eeb44e2f4f723a30e0d19e1c8325d0e384f8788
Instruction Fuzzy Hash: 6E21493024AA0D9FD7A6EFA8C859AB67BE1EF44314F5105F8D009CB1B6D639ED80C790

Function 00007FFD9B370C58 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d060a7c5003ee6fecc8e1a297f00458e13320f47fb8be1dc28e712b3aab653
Instruction ID: 6446117c3cfddad14f67df51a00c0ea341a238baa187423322f792138c7d5b0a
Opcode Fuzzy Hash: 45d060a7c5003ee6fecc8e1a297f00458e13320f47fb8be1dc28e712b3aab653
Instruction Fuzzy Hash: E721487290F69A5FD725FB7888665EA7B90FF42710F0501FFC0099B1E2DE685944C781

Function 00007FFD9B385E20 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a44c2d66bcd3dc87a2818ae6cad62f6ceeeff3c461e853e269b04a96dccd46
Instruction ID: ca262d2d41f43bfb3581a85d930442440425d973b813d82b2769880226db8851
Opcode Fuzzy Hash: c9a44c2d66bcd3dc87a2818ae6cad62f6ceeeff3c461e853e269b04a96dccd46
Instruction Fuzzy Hash: 9A11DB32B1AD0E0FEBE8F59C68A46B563D2E7D8265715013FD45DC32A4ED25EC434381

Function 00007FFD9B3860F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d650f3f818a7063870215fed4a03df5c3c62ff8f59e3a16b2578cbf7b4a5a1d1
Instruction ID: a926a0bb925a31601e4c91e78f0dff89a6c2b8d1e82f126797624739f08339c8
Opcode Fuzzy Hash: d650f3f818a7063870215fed4a03df5c3c62ff8f59e3a16b2578cbf7b4a5a1d1
Instruction Fuzzy Hash: 0111C232B1FD4D0FEAE5A4ED3CA91653AC2DB9961170641BFE80CC3277EC229C418382

Function 00007FFD9B37BE16 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92c4eb42d5fdccf6e164697350c0d5bb562c59179f3b72ff3cb29af68b49095c
Instruction ID: 133d9f985f45fcc2c9cebb537a9013a5a9343ba7be238eac89bbdcbccfe492d7
Opcode Fuzzy Hash: 92c4eb42d5fdccf6e164697350c0d5bb562c59179f3b72ff3cb29af68b49095c
Instruction Fuzzy Hash: 46110062A0AE8A0FE765EA5C44E52F477F1DB6939070501BFC449C72A3ED585D478380

Function 00007FFD9B37E938 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2f2a219c07c866bc96e62a60f92d55fa16afcf45c467310ce26ca0e451b82d
Instruction ID: 6085424b51806f0f9270137c0c750419ceb0cc85b3484bff28f68d920b29d5fb
Opcode Fuzzy Hash: 8c2f2a219c07c866bc96e62a60f92d55fa16afcf45c467310ce26ca0e451b82d
Instruction Fuzzy Hash: BB212E5170FECA0FE7A1F67C98545F53BD2DF55690B0944FED048CB2B6E8246D498341

Function 00007FFD9B374F88 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623ae1966c7974169b05679aa849c70d74941ac3441c9d75f32bc419a9bbce38
Instruction ID: 9665b2bab1e29c074411aaecec1d1e36625c9f2e007a38ceb0ad3be154c5f920
Opcode Fuzzy Hash: 623ae1966c7974169b05679aa849c70d74941ac3441c9d75f32bc419a9bbce38
Instruction Fuzzy Hash: 48218120E1F64E5FEB64FAA488A57BDB7A0EF45740F41157DD009971A3CE6869408B80

Function 00007FFD9B385312 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c25a1bba3408f0351e4fe26c639088606381301506cc0b5b988212ec7f1b3abd
Instruction ID: 95d957743e6b189172620c2572d17406343bb8faee62353cad21d033c47965ba
Opcode Fuzzy Hash: c25a1bba3408f0351e4fe26c639088606381301506cc0b5b988212ec7f1b3abd
Instruction Fuzzy Hash: 7F11A062B0EE0E4FEBB8E99C90643A463E1EBA829071505BED00DC76A5DE60ED068741

Function 00007FFD9B37CEAE Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec16b1ddc230f33648bc814a874ff68c2230423fccc8b9985adee3405591e4b
Instruction ID: 12851bda2547384bfd596d4c0adcdec59456b91ddef7daa20de59ae1c1a71532
Opcode Fuzzy Hash: 6ec16b1ddc230f33648bc814a874ff68c2230423fccc8b9985adee3405591e4b
Instruction Fuzzy Hash: 43111231B1D91D9FDB68EB5CA8A566C77D1EF98751B41016EE049C3266CE20AC0287C1

Function 00007FFD9B3CEDE0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fbdb82f7dcd37c2733ea287c30c585f12211b030c8ae3eb9f32bb6857a656ef
Instruction ID: c3dc7c1bbfc6983f3c5edfa78bad1d5e5346cf294877141facc8e875abf03918
Opcode Fuzzy Hash: 6fbdb82f7dcd37c2733ea287c30c585f12211b030c8ae3eb9f32bb6857a656ef
Instruction Fuzzy Hash: 68118C3170582D4FD6B4FAAC84A8A3A33D2EF88200B56007DE44EC36A2DE28AD418785

Function 00007FFD9B58D46A Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae14968fe9813ed8faf4fd9a95ca66cd6c6499ba4a175e08c54a57a3f5960c86
Instruction ID: 69a9989bbdb5d1863eea2267fff95d60b405b2b2adebe72d0908c2ba46b57ade
Opcode Fuzzy Hash: ae14968fe9813ed8faf4fd9a95ca66cd6c6499ba4a175e08c54a57a3f5960c86
Instruction Fuzzy Hash: FD215970A1894D8FDFA4EF98C895AEDBBE1FF58310F4001AAE51CD71A5DA34A951CB40

Function 00007FFD9B375C19 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f7e41d1c1e0e92438261be009338484f8d485c2de708677e563f065f3c54b13
Instruction ID: af0f329c3d7bb12c52418f8235d088bff5792d7357a3978c93773121b71a76e5
Opcode Fuzzy Hash: 7f7e41d1c1e0e92438261be009338484f8d485c2de708677e563f065f3c54b13
Instruction Fuzzy Hash: 9011B27050AB8D9FD745EBBC94652D97FE1EF16350B15009EC044DB262C679CC85CB44

Function 00007FFD9B37D965 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab5a4033b90abd482a9b1d96e853dac54e4ed321daff1db60651dcc1be4e393
Instruction ID: 93780a57445208c383d1691fdd5c6787fb75bce63496f605c9fcc6c4cc598fed
Opcode Fuzzy Hash: aab5a4033b90abd482a9b1d96e853dac54e4ed321daff1db60651dcc1be4e393
Instruction Fuzzy Hash: 11114C7150F7C84FD7069B7888A59517FF0EF6321170A41EFD089CB1B3D629994AC722

Function 00007FFD9B37A0F3 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa988665e8fd553706347f3a25aad3ca89e7908be935d57e092e2bb3f3752b8
Instruction ID: 27324a718d307a8825745af5d6f81b702cab000acc3d3fe836adef7efcc09943
Opcode Fuzzy Hash: 3fa988665e8fd553706347f3a25aad3ca89e7908be935d57e092e2bb3f3752b8
Instruction Fuzzy Hash: FC016D32B2A64D5FF764EFAC98BA5F97BE0EF80260F0000BFD559C31A1ED2029458741

Function 00007FFD9B37748A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29cc50685157acf6088945cbc70b7a2d9e71b926b34274944858b5abe89b5697
Instruction ID: 5f8561276400fff1b957a0b79eb932abfc05086faff4cdddb3eaa29e9bea8dd3
Opcode Fuzzy Hash: 29cc50685157acf6088945cbc70b7a2d9e71b926b34274944858b5abe89b5697
Instruction Fuzzy Hash: 0511B335E0991D8FDBA8EF9884A56BCB7B1EF59301F5111BAD00DE3252CA306981CB40

Function 00007FFD9B37A690 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e397da0ae3e4912f5e65caf6f3a61d8134ac546d0c9fce649add526e3ab169cd
Instruction ID: 9a5b5ebf052dab2dabe5416b2ca7232e363dd44b8107f8aa9fa256652db6be27
Opcode Fuzzy Hash: e397da0ae3e4912f5e65caf6f3a61d8134ac546d0c9fce649add526e3ab169cd
Instruction Fuzzy Hash: DB018631B1D90D0FD7E4E95DA89577633C6EB98360F41027AE40CC32A6ED15EC418381

Function 00007FFD9B5835A0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d7a8650f0ee3b341429dff0f6a28200433cb707b9f829f11625f543f231201
Instruction ID: 1d85454505bcb4d9a002b68f58d6e68ac0d530153bb7f89ff5fd27ab19a1af48
Opcode Fuzzy Hash: e6d7a8650f0ee3b341429dff0f6a28200433cb707b9f829f11625f543f231201
Instruction Fuzzy Hash: 4711E93160DE4A4FD395DB69C46476777D2FF84314F15417ED04DC71A5DA38E8418740

Function 00007FFD9B587744 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211e37a4f97aa4fb16ea2e23caa560b419313d2e51292e36ead2bacf1d36134d
Instruction ID: bb805d81355337f3853702b85a3f01adfdf628bbcc76fe45629957909f2b83e4
Opcode Fuzzy Hash: 211e37a4f97aa4fb16ea2e23caa560b419313d2e51292e36ead2bacf1d36134d
Instruction Fuzzy Hash: 68F0F6A3F1EE0E0EF6B8955C34161F563C1DB85A60B86027FD859C26BBDC656D434084

Function 00007FFD9B375E82 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4398b4dfca893de7ac9d58b2fde004f23fffff3b0217be1525d28fea8c129774
Instruction ID: ea65baf42c6415bb87fc86b993dcb94a149104a45a2f2abc098774d76d7dd223
Opcode Fuzzy Hash: 4398b4dfca893de7ac9d58b2fde004f23fffff3b0217be1525d28fea8c129774
Instruction Fuzzy Hash: AD11AC70E1975D9FDB15EFA884966E8BBF0FF14300F0501BED089D7162CA38A842CB41

Function 00007FFD9B583AC4 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053536173a7afa7a5aa2054e959c6e5721f43aa2ba269350f67133cb93b2371a
Instruction ID: 15da3fcad146e0f887112db75dfbf7381c7865f43d66a7bffd308452b676426d
Opcode Fuzzy Hash: 053536173a7afa7a5aa2054e959c6e5721f43aa2ba269350f67133cb93b2371a
Instruction Fuzzy Hash: F7014F21B1C91D4FEBE8EA5C9861BA873D2EB98354F5540B6D00DD32AADE35AC818781

Function 00007FFD9B37AE30 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc94c498e8462487f44656bee78d9b6ca542b3db258a43c8710288f6caad66e
Instruction ID: 55e1f2635f16d6994774023e77fa01e698fc3e1865dcb8794acfeec98a22fdb1
Opcode Fuzzy Hash: 0bc94c498e8462487f44656bee78d9b6ca542b3db258a43c8710288f6caad66e
Instruction Fuzzy Hash: 49016721B29D4E4BE7A9F71C80A4AA673D1FF98200B854579D44DC3699ED55EC418380

Function 00007FFD9B37CCB7 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d3ed0e728c88232abc31b233c46da8903d2d6a92cb3e52649052e0bfd8bd9f
Instruction ID: 35481183b6b1e8a8fe57f9b0cb85a70a7b94fcae8227d5f33804fa4f9a9612f5
Opcode Fuzzy Hash: 54d3ed0e728c88232abc31b233c46da8903d2d6a92cb3e52649052e0bfd8bd9f
Instruction Fuzzy Hash: E701F521729F4A4AD374F7389454BE263D1FFC4310F41447ED09EC7296EEA879848381

Function 00007FFD9B37BF80 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7bbc81bd3cedc4cb367508f1a63519da0d045cf9b355067fa285665c2d2d266
Instruction ID: 53722a9a45828c8e428c1d100c52afe483153e69ab4e94239383cc7491c16a35
Opcode Fuzzy Hash: c7bbc81bd3cedc4cb367508f1a63519da0d045cf9b355067fa285665c2d2d266
Instruction Fuzzy Hash: 56018B31B25D4F4FEBA8FB2894649B673E1FFA8340744457AD01DC3299ED55EC418781

Function 00007FFD9B383230 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6513aef6fb380406ebe858b65dc00ee22f85376fb99e9e82d83ee64bd99ba5
Instruction ID: 43b12d02a7cc294b925b35ef35ebbffce26ba8ca4cbf57bdb2001f08b8ce1563
Opcode Fuzzy Hash: 2c6513aef6fb380406ebe858b65dc00ee22f85376fb99e9e82d83ee64bd99ba5
Instruction Fuzzy Hash: 7501B530A09F094FD7A5FB6890596BA7BE1EFD5314F04097EE489C7370DA38D5418742

Function 00007FFD9B378A22 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d48670181df071a34008878de7857bc370fd38c8a5c1fd81639ec000f108d55
Instruction ID: 7bf54ffe99c4de60ffa3c6625e9cf139ecc33e922fe8d58254d550c6b82cfbb0
Opcode Fuzzy Hash: 2d48670181df071a34008878de7857bc370fd38c8a5c1fd81639ec000f108d55
Instruction Fuzzy Hash: 9EF0F035D4960E8BDB70EE91A0402F9F7B4EB42310F01223EC00CA3150D73ADA91CB48

Function 00007FFD9B374228 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b3577e51a96147b1d2111329901b638ba9b9387d6ad658da4d9daeb564772c
Instruction ID: 8202a65dcbea3f2bc739f78565ff0e0c7d58124b10f200043b5c304f6525b42c
Opcode Fuzzy Hash: f6b3577e51a96147b1d2111329901b638ba9b9387d6ad658da4d9daeb564772c
Instruction Fuzzy Hash: 4AF09035E4951D8BEB20EE94A4803FDF7B4EB42354F01203ED40CA7160D77AEAA5CB48

Function 00007FFD9B58EB3D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f8c4eb36d3f85179751304fe7077bbe99eca77f313d57fddd00490fccf5fa9
Instruction ID: c3d699720e57ccc6931ed431c35d7cfb53f2d0d952eb9887539fe2ca041eb8e6
Opcode Fuzzy Hash: a1f8c4eb36d3f85179751304fe7077bbe99eca77f313d57fddd00490fccf5fa9
Instruction Fuzzy Hash: 79118E31E1991D8FDBA5EBA4C8557FDB7F1EF45311F104469C049971A5C6381984CB80

Function 00007FFD9B374B89 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268a7af1a481b4a6be285dcf87e372d82bc8c15588c208c58214324bb97d6b1b
Instruction ID: 214ddd72aea7ba2ccf8e54097639c5f59199d78de357d17ac6b2f4a3aefefc85
Opcode Fuzzy Hash: 268a7af1a481b4a6be285dcf87e372d82bc8c15588c208c58214324bb97d6b1b
Instruction Fuzzy Hash: F301F76190E68D5FD755EB6888B52E87FF0EF05220F4601FBD099CB0A3ED2829498701

Function 00007FFD9B375EF3 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f77c4774bf5fe0bcfa7b6593c9acbb8459c5b534544576a91ab2d706448d591
Instruction ID: f0cc92d385e4293abd18de94524636a1199a9c351c19b7faa5ff37932acda61f
Opcode Fuzzy Hash: 7f77c4774bf5fe0bcfa7b6593c9acbb8459c5b534544576a91ab2d706448d591
Instruction Fuzzy Hash: 98016571E0461C8FCB98EF98D4906EDB7B1EF58311F40017AD41DE7294CA34A881CF80

Function 00007FFD9B58D3ED Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c50651ecd23bf0a75de905a567a56d1073977b9fae2b3123fec0a032906d982b
Instruction ID: 0002c768b9350186b081c7f2fb342ba41d5829e309cb11c2757f010f44b95b99
Opcode Fuzzy Hash: c50651ecd23bf0a75de905a567a56d1073977b9fae2b3123fec0a032906d982b
Instruction Fuzzy Hash: A0012871A0480ECFEF90EF98D8959ED77F0FF68301F900066E50DD32A2DA74A9518B80

Function 00007FFD9B37AF99 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddaa73c597619ea14d0292c460f2742323579d40c6ad6026c3914b72c7be3f6c
Instruction ID: c1c340f54151c7197b5e00d525e3d4eefacb9fce4e15ef46b20b97770dec18cb
Opcode Fuzzy Hash: ddaa73c597619ea14d0292c460f2742323579d40c6ad6026c3914b72c7be3f6c
Instruction Fuzzy Hash: 0901AD30929B8E4FDB45EF6888640A97FB0FF16200B0405ABD458C32A2DA7459148741

Function 00007FFD9B384121 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911d222629a07d934522141cd74a91b384e5fff325686f6b9698022f639e7cb3
Instruction ID: 14814f7294a9c2b8b8022ae158058695cbe9dce3098c4eb094cd18d11842445b
Opcode Fuzzy Hash: 911d222629a07d934522141cd74a91b384e5fff325686f6b9698022f639e7cb3
Instruction Fuzzy Hash: CCF0C862649ACD1FE77296A894617E53B61EF91210F0501BBD04DD6193ED242A058781

Function 00007FFD9B3725AB Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2553c382d19a52488ddee2c32bc6ad7e5288c0e7e6ddf4d8d890705c34324ce2
Instruction ID: e887ae4de60bbc870122993a9fc291442c51faf462b37188227ef2cd31b2bd2d
Opcode Fuzzy Hash: 2553c382d19a52488ddee2c32bc6ad7e5288c0e7e6ddf4d8d890705c34324ce2
Instruction Fuzzy Hash: 2201DA71E1951D8EEBA4EB589898BE9B3A1EB59301F5001E6D00DD3251DE346D81CF41

Function 00007FFD9B380B02 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1202d0ff7070d71c3b9a8f4e24d23098f720457f80fa9886a4500f6bca3d8e9a
Instruction ID: 35ec6831f9df16c9c3b7a08800bfbdfc4bb54ac618e6af695067900214f682c8
Opcode Fuzzy Hash: 1202d0ff7070d71c3b9a8f4e24d23098f720457f80fa9886a4500f6bca3d8e9a
Instruction Fuzzy Hash: 92F0F42160EACA1FE337E7B884645A07BE1EF45310B0E01FAC488CB1B3DD28E9858342

Function 00007FFD9B374B1D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf4fd2f9328de9c5eb6f30ce02f975982a5c1abef68bf1d757fffb4930321a9
Instruction ID: 96cc5f4538dfd6b4ddf11b16f05fd1736a31eedefdb90760d23abb17d5c117c9
Opcode Fuzzy Hash: ebf4fd2f9328de9c5eb6f30ce02f975982a5c1abef68bf1d757fffb4930321a9
Instruction Fuzzy Hash: 8A01D130A0A68D8FDB54EF24C8A12E97BA1FF55300F0604BEE40CC7292DA79EA51C780

Function 00007FFD9B374DD6 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5915c86da06b49c5e98df48d8edfee47f65a8d2881a62ae2dad9d8cd1b74345
Instruction ID: 7e3f4c68685117a41f5a6d7329bc758c90292d53a6388cf744c6f52befe4ec94
Opcode Fuzzy Hash: c5915c86da06b49c5e98df48d8edfee47f65a8d2881a62ae2dad9d8cd1b74345
Instruction Fuzzy Hash: 9801E831E0590D8FEBA8EB58D8A0BACB7B1EF58304F5081B9D00DE3299CE756981CB00

Function 00007FFD9B373B3E Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2902bf9a617537b6f6b99875d7d7b0b4ab76d76380c05d9b9490dbc8c1e45f33
Instruction ID: 0a796f26a59319440b83584acc0746260c3abcf4a4950200f6f95ce6ba81c2d0
Opcode Fuzzy Hash: 2902bf9a617537b6f6b99875d7d7b0b4ab76d76380c05d9b9490dbc8c1e45f33
Instruction Fuzzy Hash: 6FF09075E0951DAFCF50EB9C94905FDB7F0EFA8321B0001BBD448E7251DB389A458780

Function 00007FFD9B373E50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40941592388a80ebb02ca6fdc7dd883e60840f1ac91883998946570297f0c733
Instruction ID: 0d3b20021776e22bb79ff7cd815b57a854580aa28353e3c33879cf39daaa5733
Opcode Fuzzy Hash: 40941592388a80ebb02ca6fdc7dd883e60840f1ac91883998946570297f0c733
Instruction Fuzzy Hash: 5FF08C31D0660C8BD720AEA9A0403F9F7B4EB4A305F41203DD00CA3190C37A9696CB54

Function 00007FFD9B382DE5 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12c8c9af1ddd2de9c11b8909d853d4ffbd8a76527c0495ee3466728ccac7c198
Instruction ID: 62e723abbcf611e1dce930bcc10858fee7c428d0df43148eb2ea14de45e6d74c
Opcode Fuzzy Hash: 12c8c9af1ddd2de9c11b8909d853d4ffbd8a76527c0495ee3466728ccac7c198
Instruction Fuzzy Hash: 2FF02E31719D1D0BDA74F2A85074AF623D1EF95710F41043DD44EC22D1DC6868428341

Function 00007FFD9B375038 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b0984fe74ce5a60ee766d70664986e0e06f68f26f72dc8e057cbf91ac064b2c
Instruction ID: ec82eb79c47613bb084b1c13c28ecf253f584aec63f30aafc0cbfcb964e14eab
Opcode Fuzzy Hash: 1b0984fe74ce5a60ee766d70664986e0e06f68f26f72dc8e057cbf91ac064b2c
Instruction Fuzzy Hash: FEF01D31F05A2D8EDBA4EE589860BE8B372FB55255F0045B5D01DE3195CE35AD418B41

Function 00007FFD9B378691 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e191324d4aaea9975794b0f3cb10e2f049cd143d3aa1f67be70c2cdda150e3
Instruction ID: 49572c036dcdcae62eb2330b5831e3c77f5e7736539ef5c62ce1f091f86ae000
Opcode Fuzzy Hash: 75e191324d4aaea9975794b0f3cb10e2f049cd143d3aa1f67be70c2cdda150e3
Instruction Fuzzy Hash: DFF03031D4560D9FC724EE95E4903FDB6B4FB4A205F41263DD10CA3191D7B99694CB44

Function 00007FFD9B384F25 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5f5b7b86fc4a762473ceb8cbc7c24e793e08b6f3f6531b534e7b74b421bba6
Instruction ID: 2e69a32c97ac2a70cc1f309647a14bd91df548420287e9de70ffa256cb7cbe98
Opcode Fuzzy Hash: 7e5f5b7b86fc4a762473ceb8cbc7c24e793e08b6f3f6531b534e7b74b421bba6
Instruction Fuzzy Hash: C4F0E931919E4E4FD365EB98C4556A077D0FF08300B4601AED448C72A3EE29ED918781

Function 00007FFD9B375DC7 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ee219d3c0db1e3b345c5ebcc008d3f94f376a964fff04409de6880ae4cee8b
Instruction ID: c9fd508e26409eaa06e753760a7f19833394cab115bee056ffe381b88b1d5eb2
Opcode Fuzzy Hash: 58ee219d3c0db1e3b345c5ebcc008d3f94f376a964fff04409de6880ae4cee8b
Instruction Fuzzy Hash: 7BF04970A1978D9FCB40EFAC88956D9BBF1EF15704F4100AAD488DB265DA34AD85CB41

Function 00007FFD9B58C2B1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274fb77609cd9366df535ab40ae25475bc4edc7175addc8c169cedea2d7171e2
Instruction ID: 4b5616cb290a3783b12819bc30fe4239d21fa878aee6c2d8a23dca2990d276e4
Opcode Fuzzy Hash: 274fb77609cd9366df535ab40ae25475bc4edc7175addc8c169cedea2d7171e2
Instruction Fuzzy Hash: D2E0E55250FAC90BD751927C48655847F90FF65220F8943BBD4C8CB0A3E41CA6464342

Function 00007FFD9B375E26 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4980bd6fa4eb7f21f034f5fdfb9017de643e18f5fb0729d83c894646ad44809a
Instruction ID: 215e9598d35dae4783531d4a4240b0c8fe535359b22685c59db573f0f4bd49c5
Opcode Fuzzy Hash: 4980bd6fa4eb7f21f034f5fdfb9017de643e18f5fb0729d83c894646ad44809a
Instruction Fuzzy Hash: 91F0F671A0DB8D5FDB51DB7884157E5BBE0EF65350F1401EEC04CC7156DD3498858740

Function 00007FFD9B3780DD Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983681c7c058c4f6848b694f98173ff0c7ebca41c393f59acd27ce1cddf1c1f2
Instruction ID: 1b4cb2ae6e70f3c8a6c703c96586d4f25c04d9061f781c76a1e24c8d89998701
Opcode Fuzzy Hash: 983681c7c058c4f6848b694f98173ff0c7ebca41c393f59acd27ce1cddf1c1f2
Instruction Fuzzy Hash: 78F05E70A4965E5FDBA9FE6884253EA72E1EB44710F0149BF900DE7292DF785A848A80

Function 00007FFD9B37BC4A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380c985a4b052afc9184117b42ac4e36b8d54063708c04202df85d1cab37b2cd
Instruction ID: ec1b55b8d52c9be607fa98a393c43ba6c4f6a84afbd599921207e8d5f7c57434
Opcode Fuzzy Hash: 380c985a4b052afc9184117b42ac4e36b8d54063708c04202df85d1cab37b2cd
Instruction Fuzzy Hash: F3F05475E2551E9BEB98F79888E5EAC73F2FF98B40F814034E048D33A2DE296C418701

Function 00007FFD9B37A0A5 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2838b5936954ac255bd0bc195e205162a7970f1d3efbf9dcb577780ec8111bf
Instruction ID: f8f2431360adcb7a08f2aebaff23d53122894b945cf69d81b470e2b640e02514
Opcode Fuzzy Hash: e2838b5936954ac255bd0bc195e205162a7970f1d3efbf9dcb577780ec8111bf
Instruction Fuzzy Hash: B2E06872A6624E6BD755BBA8B8319FBB794EF41370B4004FFC16ECB043DD6024548652

Function 00007FFD9B37AF5E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2276dcfab841f79a9bf9db4aac6aa6b9eaa973362389aa2bf6bf2e51fa43883a
Instruction ID: c4fb0eab8fa450670707fda8b83c862beb61c83a474cede189aee30932924026
Opcode Fuzzy Hash: 2276dcfab841f79a9bf9db4aac6aa6b9eaa973362389aa2bf6bf2e51fa43883a
Instruction Fuzzy Hash: 46E0D88181F6DA0FE752A7B44C6A9907F90EF17210B0D81FAD088CB0A3E54D61058342

Function 00007FFD9B37A0A8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835d39b9e7583c763e9524b7e5cb1e916ad6a4a218e180eb1caaff61b1900011
Instruction ID: 9d2bff84c2775bc7f52e2c4bc61ef7035d33c86fd33712f253eb0334304edcfa
Opcode Fuzzy Hash: 835d39b9e7583c763e9524b7e5cb1e916ad6a4a218e180eb1caaff61b1900011
Instruction Fuzzy Hash: 3EE0D871A2610A5BE755BBA878326FAB790EF01370B4004FFD07EC7187DDA429548652

Function 00007FFD9B591C6D Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ee255fdb9444c4994613af7d506cbc3b7e9d0c1f01a384dc9b5c79a25a4118
Instruction ID: 7faa8c27d51e4500af64e68ed26ae8faed17448165c5b9f2fdf7e4413bd7332e
Opcode Fuzzy Hash: c6ee255fdb9444c4994613af7d506cbc3b7e9d0c1f01a384dc9b5c79a25a4118
Instruction Fuzzy Hash: 3EF0A03070A94E5FDFEADF1884A19663BA2EFA8344B54056CD41ACB19ACD28E9018781

Function 00007FFD9B378075 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da49bedd9bc63354ee87a3cb52ca63b47c507f1a87f316d542de7a471aa15dea
Instruction ID: a68f8532efea258f8f9030281fb538bb225384a087e7edd5fd849502a2654435
Opcode Fuzzy Hash: da49bedd9bc63354ee87a3cb52ca63b47c507f1a87f316d542de7a471aa15dea
Instruction Fuzzy Hash: 34E0E531E0451C8EDB54EB68D851BECB7B1FF54205F4040BAE01CE3296CB7569818B01

Function 00007FFD9B373B03 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb83c6145d65500df3c63cc0f84ebf63ba1fa5650183f1fdf7e4dc3a923ddb0
Instruction ID: ab31df3a037ff1d59d1d3148b0a872eb004956ccb0f513db850609b67c0952f1
Opcode Fuzzy Hash: 7fb83c6145d65500df3c63cc0f84ebf63ba1fa5650183f1fdf7e4dc3a923ddb0
Instruction Fuzzy Hash: DEE0927190DA896FDB41EBB884968DDBFF09F15210B1800ADC048DB163C92894C1CB51

Function 00007FFD9B384190 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45fe1af8eb28652b90fbdbe72d5f8f071e355cfc792c1236cae9094873425c92
Instruction ID: fe29670cac49af8a2f9b520a017237b666884ce6862320569ab0655f65d39e4a
Opcode Fuzzy Hash: 45fe1af8eb28652b90fbdbe72d5f8f071e355cfc792c1236cae9094873425c92
Instruction Fuzzy Hash: DEE01A70A1881D4EEB69EBA8C8653AC73A0FF54304F10017E900DD3292CE3459028B40

Function 00007FFD9B38EE10 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531b10213ffca687414895c186f3427197af90cf4053aeb7bcaf825170fcdc35
Instruction ID: a3cd542a81bfa40521abf6e32ca9faf08415f538cfb31229ef3a9bfe82c265e0
Opcode Fuzzy Hash: 531b10213ffca687414895c186f3427197af90cf4053aeb7bcaf825170fcdc35
Instruction Fuzzy Hash: A9E04F1010F69E1FCB42FABC48A64D93BD05F0669070544E9D0498F0A2E11C584EC302

Function 00007FFD9B58BF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2978116606.00007FFD9B580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b580000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79cc3bdc3bb5adf966231ce3750edff73c47f7e3102236423abc913005c20691
Instruction ID: 478a893694e33132d3bdb67669c3c9405bd7f45996fb04738114e9be3c943df6
Opcode Fuzzy Hash: 79cc3bdc3bb5adf966231ce3750edff73c47f7e3102236423abc913005c20691
Instruction Fuzzy Hash: 1BC08C00B29C2D05BEF470B834191F493C08B50115F4204FADC08D21F6DD4A0E8A01C3

Function 00007FFD9B382993 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8cdb27caca7fcf7476acbab63ba123a66b483e5ea0cd9c9337e10140f265b9
Instruction ID: 793805c88a0d9f158de0e37817624090711700ad36613f8dcaae57fa55725c7a
Opcode Fuzzy Hash: 6e8cdb27caca7fcf7476acbab63ba123a66b483e5ea0cd9c9337e10140f265b9
Instruction Fuzzy Hash: 37D05E3060D2404FCB68AE28A080C80B790EF1220835509E8E0144B1E7C92ADC82CF01

Function 00007FFD9B379ED3 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d069d2297ae427f8442de421fb8ff401ae8f621643eadbf010ea6fb5c2c984
Instruction ID: 082fdbe0c7c8b816795888beacc7608a35e401d5bb57d5486aeecdf56d2237cd
Opcode Fuzzy Hash: e3d069d2297ae427f8442de421fb8ff401ae8f621643eadbf010ea6fb5c2c984
Instruction Fuzzy Hash: 5BC04C11F5AC2F1A94B5E14C38A52A900C2DB8892074A13A9D80DC7259CD189E8202C1

Function 00007FFD9B37D230 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4fb676fdd0bb54fee4d866f66fc5eea4e604bfeb8d7a8fe14b3eef7ccb3662
Instruction ID: 64b6529ec3915e72358d4f278d94e890fedea7f39d8ed62a8cd88a5f69a1b989
Opcode Fuzzy Hash: dc4fb676fdd0bb54fee4d866f66fc5eea4e604bfeb8d7a8fe14b3eef7ccb3662
Instruction Fuzzy Hash: E0C0025952E19110F70533B875679EC1B401F0332974892F1E16D0E6D74C8918855149

Function 00007FFD9B37AB00 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e296858d045a8122cda6a7f09fe3f136c0cf456cfc99666725f3b701ed3f8ab9
Instruction ID: 38bf1e9bfb8a1290cbda012a2e7ffe024520a622a35f0bf6dd7d3c6ad676a5a6
Opcode Fuzzy Hash: e296858d045a8122cda6a7f09fe3f136c0cf456cfc99666725f3b701ed3f8ab9
Instruction Fuzzy Hash: 9FC08C2093590D4ACB28F72848810147AD0FF08200FC001F8E00CC2284D66D91506745

Function 00007FFD9B375D2A Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d5ca5db3ca54b9f56e369b377baecfef51a6fc91f919f1d0ab6184a7621fbe
Instruction ID: a4c34fed3bf84d88663f36ca221fe7829e783114ca4eb13956bef3074592737b
Opcode Fuzzy Hash: 57d5ca5db3ca54b9f56e369b377baecfef51a6fc91f919f1d0ab6184a7621fbe
Instruction Fuzzy Hash: 19C09B62D0D91D4FFBD4DA5C44D85DC77E1FFB8255B010135D008D3154DF3068015740

Function 00007FFD9B3781AE Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2972326508.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b370000_AteraAgent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b922fad7d8a4698d276df24b30224bcb4e03984c41d9259bfc2556a0f0b08db6
Instruction ID: a1ea7cb32eeba19be41c95e5c0b74f38c61ea4425a75c438640d2620bf38aa3a
Opcode Fuzzy Hash: b922fad7d8a4698d276df24b30224bcb4e03984c41d9259bfc2556a0f0b08db6
Instruction Fuzzy Hash: EFC02B3060121D9FC382DE7C443C7C93AD04F00050B0400EF804CCB1D1D6344CC94704

Analysis Process: rundll32.exePID: 3132, Parent PID: 7448COMMON

Executed Functions

Function 0472746A Relevance: 20.9, Strings: 16, Instructions: 920COMMON

Download Yara Rule

Strings

$^q, xrefs: 04727C78
4'^q, xrefs: 04727DA3
$&_q, xrefs: 047279E4
(_^q, xrefs: 04727B5B
`q, xrefs: 047276C0
@b^q, xrefs: 04727CEA
`q, xrefs: 047275F4
4c^q, xrefs: 047279B1
$^q, xrefs: 047283D0
c^q, xrefs: 04727A7D
4'^q, xrefs: 04727D49
c^q, xrefs: 047282B9
4c^q, xrefs: 04728316
4'^q, xrefs: 04727E00
|-_q, xrefs: 04727528
4'^q, xrefs: 04728373

Memory Dump Source

Source File: 00000011.00000003.1881089160.0000000004720000.00000040.00000800.00020000.00000000.sdmp, Offset: 04720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_4720000_rundll32.jbxd

Similarity

API ID:
String ID: `q$$&_q$(_^q$4'^q$4'^q$4'^q$4'^q$4c^q$4c^q$@b^q$|-_q$$^q$$^q$c^q$c^q$`q
API String ID: 0-3238858861
Opcode ID: 32d937d98b8a0ffd60eeb1bfa0ef9969c74a0e59035c102dcd6b6f869b7c4425
Instruction ID: 32607c1a894651ebf92aa4acc7385307295528bf60158b8cf0ee8ad407f941a4
Opcode Fuzzy Hash: 32d937d98b8a0ffd60eeb1bfa0ef9969c74a0e59035c102dcd6b6f869b7c4425
Instruction Fuzzy Hash: 51A2F630A4121CDFDB259F64C954AEEBBB2FF89300F1045EAD5096B264DB369E85CF81

Function 04809FE0 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 04809FF8

Memory Dump Source

Source File: 00000011.00000003.1881125456.0000000004800000.00000040.00000800.00020000.00000000.sdmp, Offset: 04800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_4800000_rundll32.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: bd7b3278066f6c4ec22730cb83a7d6314c0b8ab794881a311ce4b3c4ac36ffff
Instruction ID: 5b28db30a1edd0e00114678f9a1a0c6412bad631b623e6acbc6ada6ba5138b8c
Opcode Fuzzy Hash: bd7b3278066f6c4ec22730cb83a7d6314c0b8ab794881a311ce4b3c4ac36ffff
Instruction Fuzzy Hash: 6C112B35E1130CDBEB18DA78D8403DD77A5EB94328F14CA25D915E32D0EA36B949CB51

Function 04809FD0 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 04809FF8

Memory Dump Source

Source File: 00000011.00000003.1881125456.0000000004800000.00000040.00000800.00020000.00000000.sdmp, Offset: 04800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_4800000_rundll32.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9aefe56dac2428ae429087ef5b9fe9bdad1fc86532f9cde9a5425eb7c9911445
Instruction ID: 19f4bfe89ae334a2d13822315ded5315dda81ffdd806943fa864b54c00b8f12f
Opcode Fuzzy Hash: 9aefe56dac2428ae429087ef5b9fe9bdad1fc86532f9cde9a5425eb7c9911445
Instruction Fuzzy Hash: 29112731E21349DBEB18DE34C8403DEBB61EB99368F14CA14D805A31D0EB32B94ECB51

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RQ--029.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\5323c1.rbs

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config

C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll

C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll

C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config

Windows Analysis Report
RQ--029.msi

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre